17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate * CDDL HEADER START
37c478bd9Sstevel@tonic-gate *
47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the
5bffb04cfSmarkfen * Common Development and Distribution License (the "License").
6bffb04cfSmarkfen * You may not use this file except in compliance with the License.
77c478bd9Sstevel@tonic-gate *
87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions
117c478bd9Sstevel@tonic-gate * and limitations under the License.
127c478bd9Sstevel@tonic-gate *
137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bd9Sstevel@tonic-gate *
197c478bd9Sstevel@tonic-gate * CDDL HEADER END
207c478bd9Sstevel@tonic-gate */
217c478bd9Sstevel@tonic-gate /*
22930af642SDan McDonald * Copyright 2010 Sun Microsystems, Inc. All rights reserved.
237c478bd9Sstevel@tonic-gate * Use is subject to license terms.
2469e71331SBayard Bell * Copyright (c) 2012 Nexenta Systems, Inc. All rights reserved.
25281819e5SDan McDonald * Copyright 2017 Joyent, Inc.
267c478bd9Sstevel@tonic-gate */
277c478bd9Sstevel@tonic-gate
287c478bd9Sstevel@tonic-gate #include <sys/types.h>
297c478bd9Sstevel@tonic-gate #include <sys/stream.h>
307c478bd9Sstevel@tonic-gate #include <sys/stropts.h>
317c478bd9Sstevel@tonic-gate #include <sys/errno.h>
327c478bd9Sstevel@tonic-gate #include <sys/strlog.h>
337c478bd9Sstevel@tonic-gate #include <sys/tihdr.h>
347c478bd9Sstevel@tonic-gate #include <sys/socket.h>
357c478bd9Sstevel@tonic-gate #include <sys/ddi.h>
367c478bd9Sstevel@tonic-gate #include <sys/sunddi.h>
379c2c14abSThejaswini Singarajipura #include <sys/mkdev.h>
387c478bd9Sstevel@tonic-gate #include <sys/kmem.h>
39f4b3ec61Sdh #include <sys/zone.h>
4032350c00Sdanmcd #include <sys/sysmacros.h>
417c478bd9Sstevel@tonic-gate #include <sys/cmn_err.h>
427c478bd9Sstevel@tonic-gate #include <sys/vtrace.h>
437c478bd9Sstevel@tonic-gate #include <sys/debug.h>
447c478bd9Sstevel@tonic-gate #include <sys/atomic.h>
457c478bd9Sstevel@tonic-gate #include <sys/strsun.h>
467c478bd9Sstevel@tonic-gate #include <sys/random.h>
477c478bd9Sstevel@tonic-gate #include <netinet/in.h>
487c478bd9Sstevel@tonic-gate #include <net/if.h>
497c478bd9Sstevel@tonic-gate #include <netinet/ip6.h>
507c478bd9Sstevel@tonic-gate #include <netinet/icmp6.h>
517c478bd9Sstevel@tonic-gate #include <net/pfkeyv2.h>
52628b0c67SMark Fenwick #include <net/pfpolicy.h>
537c478bd9Sstevel@tonic-gate
547c478bd9Sstevel@tonic-gate #include <inet/common.h>
557c478bd9Sstevel@tonic-gate #include <inet/mi.h>
567c478bd9Sstevel@tonic-gate #include <inet/ip.h>
577c478bd9Sstevel@tonic-gate #include <inet/ip6.h>
587c478bd9Sstevel@tonic-gate #include <inet/nd.h>
59bd670b35SErik Nordmark #include <inet/ip_if.h>
60bd670b35SErik Nordmark #include <inet/ip_ndp.h>
617c478bd9Sstevel@tonic-gate #include <inet/ipsec_info.h>
627c478bd9Sstevel@tonic-gate #include <inet/ipsec_impl.h>
637c478bd9Sstevel@tonic-gate #include <inet/sadb.h>
647c478bd9Sstevel@tonic-gate #include <inet/ipsecah.h>
657c478bd9Sstevel@tonic-gate #include <inet/ipsec_impl.h>
667c478bd9Sstevel@tonic-gate #include <inet/ipdrop.h>
677c478bd9Sstevel@tonic-gate #include <sys/taskq.h>
687c478bd9Sstevel@tonic-gate #include <sys/policy.h>
697c478bd9Sstevel@tonic-gate #include <sys/strsun.h>
707c478bd9Sstevel@tonic-gate
717c478bd9Sstevel@tonic-gate #include <sys/crypto/common.h>
727c478bd9Sstevel@tonic-gate #include <sys/crypto/api.h>
737c478bd9Sstevel@tonic-gate #include <sys/kstat.h>
7445916cd2Sjpk #include <sys/strsubr.h>
757c478bd9Sstevel@tonic-gate
765d3b8cb7SBill Sommerfeld #include <sys/tsol/tnet.h>
775d3b8cb7SBill Sommerfeld
787c478bd9Sstevel@tonic-gate /*
797c478bd9Sstevel@tonic-gate * Table of ND variables supported by ipsecah. These are loaded into
807c478bd9Sstevel@tonic-gate * ipsecah_g_nd in ipsecah_init_nd.
817c478bd9Sstevel@tonic-gate * All of these are alterable, within the min/max values given, at run time.
827c478bd9Sstevel@tonic-gate */
83f4b3ec61Sdh static ipsecahparam_t lcl_param_arr[] = {
847c478bd9Sstevel@tonic-gate /* min max value name */
857c478bd9Sstevel@tonic-gate { 0, 3, 0, "ipsecah_debug"},
867c478bd9Sstevel@tonic-gate { 125, 32000, SADB_AGE_INTERVAL_DEFAULT, "ipsecah_age_interval"},
877c478bd9Sstevel@tonic-gate { 1, 10, 1, "ipsecah_reap_delay"},
887c478bd9Sstevel@tonic-gate { 1, SADB_MAX_REPLAY, 64, "ipsecah_replay_size"},
897c478bd9Sstevel@tonic-gate { 1, 300, 15, "ipsecah_acquire_timeout"},
907c478bd9Sstevel@tonic-gate { 1, 1800, 90, "ipsecah_larval_timeout"},
917c478bd9Sstevel@tonic-gate /* Default lifetime values for ACQUIRE messages. */
927c478bd9Sstevel@tonic-gate { 0, 0xffffffffU, 0, "ipsecah_default_soft_bytes"},
937c478bd9Sstevel@tonic-gate { 0, 0xffffffffU, 0, "ipsecah_default_hard_bytes"},
947c478bd9Sstevel@tonic-gate { 0, 0xffffffffU, 24000, "ipsecah_default_soft_addtime"},
957c478bd9Sstevel@tonic-gate { 0, 0xffffffffU, 28800, "ipsecah_default_hard_addtime"},
967c478bd9Sstevel@tonic-gate { 0, 0xffffffffU, 0, "ipsecah_default_soft_usetime"},
977c478bd9Sstevel@tonic-gate { 0, 0xffffffffU, 0, "ipsecah_default_hard_usetime"},
987c478bd9Sstevel@tonic-gate { 0, 1, 0, "ipsecah_log_unknown_spi"},
997c478bd9Sstevel@tonic-gate };
1007c478bd9Sstevel@tonic-gate
1017c478bd9Sstevel@tonic-gate #define ah0dbg(a) printf a
1027c478bd9Sstevel@tonic-gate /* NOTE: != 0 instead of > 0 so lint doesn't complain. */
103f4b3ec61Sdh #define ah1dbg(ahstack, a) if (ahstack->ipsecah_debug != 0) printf a
104f4b3ec61Sdh #define ah2dbg(ahstack, a) if (ahstack->ipsecah_debug > 1) printf a
105f4b3ec61Sdh #define ah3dbg(ahstack, a) if (ahstack->ipsecah_debug > 2) printf a
1067c478bd9Sstevel@tonic-gate
1077c478bd9Sstevel@tonic-gate /*
1087c478bd9Sstevel@tonic-gate * XXX This is broken. Padding should be determined dynamically
1097c478bd9Sstevel@tonic-gate * depending on the ICV size and IP version number so that the
1107c478bd9Sstevel@tonic-gate * total AH header size is a multiple of 32 bits or 64 bits
1117c478bd9Sstevel@tonic-gate * for V4 and V6 respectively. For 96bit ICVs we have no problems.
1127c478bd9Sstevel@tonic-gate * Anything different from that, we need to fix our code.
1137c478bd9Sstevel@tonic-gate */
1147c478bd9Sstevel@tonic-gate #define IPV4_PADDING_ALIGN 0x04 /* Multiple of 32 bits */
1157c478bd9Sstevel@tonic-gate #define IPV6_PADDING_ALIGN 0x04 /* Multiple of 32 bits */
1167c478bd9Sstevel@tonic-gate
1177c478bd9Sstevel@tonic-gate /*
1187c478bd9Sstevel@tonic-gate * Helper macro. Avoids a call to msgdsize if there is only one
1197c478bd9Sstevel@tonic-gate * mblk in the chain.
1207c478bd9Sstevel@tonic-gate */
1217c478bd9Sstevel@tonic-gate #define AH_MSGSIZE(mp) ((mp)->b_cont != NULL ? msgdsize(mp) : MBLKL(mp))
1227c478bd9Sstevel@tonic-gate
123f4b3ec61Sdh
124bd670b35SErik Nordmark static mblk_t *ah_auth_out_done(mblk_t *, ip_xmit_attr_t *, ipsec_crypto_t *);
125bd670b35SErik Nordmark static mblk_t *ah_auth_in_done(mblk_t *, ip_recv_attr_t *, ipsec_crypto_t *);
1267c478bd9Sstevel@tonic-gate static mblk_t *ah_process_ip_options_v4(mblk_t *, ipsa_t *, int *, uint_t,
127f4b3ec61Sdh boolean_t, ipsecah_stack_t *);
1287c478bd9Sstevel@tonic-gate static mblk_t *ah_process_ip_options_v6(mblk_t *, ipsa_t *, int *, uint_t,
129f4b3ec61Sdh boolean_t, ipsecah_stack_t *);
130f4b3ec61Sdh static void ah_getspi(mblk_t *, keysock_in_t *, ipsecah_stack_t *);
131bd670b35SErik Nordmark static void ah_inbound_restart(mblk_t *, ip_recv_attr_t *);
132bd670b35SErik Nordmark
133bd670b35SErik Nordmark static mblk_t *ah_outbound(mblk_t *, ip_xmit_attr_t *);
134bd670b35SErik Nordmark static void ah_outbound_finish(mblk_t *, ip_xmit_attr_t *);
1357c478bd9Sstevel@tonic-gate
1367c478bd9Sstevel@tonic-gate static int ipsecah_open(queue_t *, dev_t *, int, int, cred_t *);
1375e1743f0SToomas Soome static int ipsecah_close(queue_t *, int, cred_t *);
138d81c80caSToomas Soome static int ipsecah_rput(queue_t *, mblk_t *);
139d81c80caSToomas Soome static int ipsecah_wput(queue_t *, mblk_t *);
1405d3b8cb7SBill Sommerfeld static boolean_t ah_register_out(uint32_t, uint32_t, uint_t, ipsecah_stack_t *,
141bd670b35SErik Nordmark cred_t *);
142f4b3ec61Sdh static void *ipsecah_stack_init(netstackid_t stackid, netstack_t *ns);
143f4b3ec61Sdh static void ipsecah_stack_fini(netstackid_t stackid, void *arg);
144f4b3ec61Sdh
145f4b3ec61Sdh /* Setable in /etc/system */
146f4b3ec61Sdh uint32_t ah_hash_size = IPSEC_DEFAULT_HASH_SIZE;
147f4b3ec61Sdh
148f4b3ec61Sdh static taskq_t *ah_taskq;
1497c478bd9Sstevel@tonic-gate
1507c478bd9Sstevel@tonic-gate static struct module_info info = {
1517c478bd9Sstevel@tonic-gate 5136, "ipsecah", 0, INFPSZ, 65536, 1024
1527c478bd9Sstevel@tonic-gate };
1537c478bd9Sstevel@tonic-gate
1547c478bd9Sstevel@tonic-gate static struct qinit rinit = {
155d81c80caSToomas Soome ipsecah_rput, NULL, ipsecah_open, ipsecah_close, NULL, &info,
1567c478bd9Sstevel@tonic-gate NULL
1577c478bd9Sstevel@tonic-gate };
1587c478bd9Sstevel@tonic-gate
1597c478bd9Sstevel@tonic-gate static struct qinit winit = {
160d81c80caSToomas Soome ipsecah_wput, NULL, ipsecah_open, ipsecah_close, NULL, &info,
1617c478bd9Sstevel@tonic-gate NULL
1627c478bd9Sstevel@tonic-gate };
1637c478bd9Sstevel@tonic-gate
1647c478bd9Sstevel@tonic-gate struct streamtab ipsecahinfo = {
1657c478bd9Sstevel@tonic-gate &rinit, &winit, NULL, NULL
1667c478bd9Sstevel@tonic-gate };
1677c478bd9Sstevel@tonic-gate
1687c478bd9Sstevel@tonic-gate static int ah_kstat_update(kstat_t *, int);
1697c478bd9Sstevel@tonic-gate
170bffb04cfSmarkfen uint64_t ipsacq_maxpackets = IPSACQ_MAXPACKETS;
171bffb04cfSmarkfen
1727c478bd9Sstevel@tonic-gate static boolean_t
ah_kstat_init(ipsecah_stack_t * ahstack,netstackid_t stackid)173f4b3ec61Sdh ah_kstat_init(ipsecah_stack_t *ahstack, netstackid_t stackid)
1747c478bd9Sstevel@tonic-gate {
175f4b3ec61Sdh ipsec_stack_t *ipss = ahstack->ipsecah_netstack->netstack_ipsec;
1767c478bd9Sstevel@tonic-gate
177f4b3ec61Sdh ahstack->ah_ksp = kstat_create_netstack("ipsecah", 0, "ah_stat", "net",
178281819e5SDan McDonald KSTAT_TYPE_NAMED, sizeof (ah_kstats_t) / sizeof (kstat_named_t), 0,
179281819e5SDan McDonald stackid);
1807c478bd9Sstevel@tonic-gate
181f4b3ec61Sdh if (ahstack->ah_ksp == NULL || ahstack->ah_ksp->ks_data == NULL)
1827c478bd9Sstevel@tonic-gate return (B_FALSE);
1837c478bd9Sstevel@tonic-gate
184f4b3ec61Sdh ahstack->ah_kstats = ahstack->ah_ksp->ks_data;
1857c478bd9Sstevel@tonic-gate
186f4b3ec61Sdh ahstack->ah_ksp->ks_update = ah_kstat_update;
187f4b3ec61Sdh ahstack->ah_ksp->ks_private = (void *)(uintptr_t)stackid;
1887c478bd9Sstevel@tonic-gate
1897c478bd9Sstevel@tonic-gate #define K64 KSTAT_DATA_UINT64
190f4b3ec61Sdh #define KI(x) kstat_named_init(&(ahstack->ah_kstats->ah_stat_##x), #x, K64)
1917c478bd9Sstevel@tonic-gate
1927c478bd9Sstevel@tonic-gate KI(num_aalgs);
1937c478bd9Sstevel@tonic-gate KI(good_auth);
1947c478bd9Sstevel@tonic-gate KI(bad_auth);
1957c478bd9Sstevel@tonic-gate KI(replay_failures);
1967c478bd9Sstevel@tonic-gate KI(replay_early_failures);
1977c478bd9Sstevel@tonic-gate KI(keysock_in);
1987c478bd9Sstevel@tonic-gate KI(out_requests);
1997c478bd9Sstevel@tonic-gate KI(acquire_requests);
2007c478bd9Sstevel@tonic-gate KI(bytes_expired);
2017c478bd9Sstevel@tonic-gate KI(out_discards);
2027c478bd9Sstevel@tonic-gate KI(crypto_sync);
2037c478bd9Sstevel@tonic-gate KI(crypto_async);
2047c478bd9Sstevel@tonic-gate KI(crypto_failures);
2057c478bd9Sstevel@tonic-gate
2067c478bd9Sstevel@tonic-gate #undef KI
2077c478bd9Sstevel@tonic-gate #undef K64
2087c478bd9Sstevel@tonic-gate
209f4b3ec61Sdh kstat_install(ahstack->ah_ksp);
210f4b3ec61Sdh IP_ACQUIRE_STAT(ipss, maxpackets, ipsacq_maxpackets);
2117c478bd9Sstevel@tonic-gate return (B_TRUE);
2127c478bd9Sstevel@tonic-gate }
2137c478bd9Sstevel@tonic-gate
2147c478bd9Sstevel@tonic-gate static int
ah_kstat_update(kstat_t * kp,int rw)2157c478bd9Sstevel@tonic-gate ah_kstat_update(kstat_t *kp, int rw)
2167c478bd9Sstevel@tonic-gate {
217f4b3ec61Sdh ah_kstats_t *ekp;
218*a23b3b1bSToomas Soome netstackid_t stackid;
219f4b3ec61Sdh netstack_t *ns;
220f4b3ec61Sdh ipsec_stack_t *ipss;
2217c478bd9Sstevel@tonic-gate
2227c478bd9Sstevel@tonic-gate if ((kp == NULL) || (kp->ks_data == NULL))
2237c478bd9Sstevel@tonic-gate return (EIO);
2247c478bd9Sstevel@tonic-gate
2257c478bd9Sstevel@tonic-gate if (rw == KSTAT_WRITE)
2267c478bd9Sstevel@tonic-gate return (EACCES);
2277c478bd9Sstevel@tonic-gate
228*a23b3b1bSToomas Soome stackid = (netstackid_t)(uintptr_t)kp->ks_private;
229f4b3ec61Sdh ns = netstack_find_by_stackid(stackid);
230f4b3ec61Sdh if (ns == NULL)
231f4b3ec61Sdh return (-1);
232f4b3ec61Sdh ipss = ns->netstack_ipsec;
233f4b3ec61Sdh if (ipss == NULL) {
234f4b3ec61Sdh netstack_rele(ns);
235f4b3ec61Sdh return (-1);
236f4b3ec61Sdh }
2377c478bd9Sstevel@tonic-gate ekp = (ah_kstats_t *)kp->ks_data;
2387c478bd9Sstevel@tonic-gate
23969e71331SBayard Bell rw_enter(&ipss->ipsec_alg_lock, RW_READER);
240f4b3ec61Sdh ekp->ah_stat_num_aalgs.value.ui64 = ipss->ipsec_nalgs[IPSEC_ALG_AUTH];
24169e71331SBayard Bell rw_exit(&ipss->ipsec_alg_lock);
2427c478bd9Sstevel@tonic-gate
243f4b3ec61Sdh netstack_rele(ns);
2447c478bd9Sstevel@tonic-gate return (0);
2457c478bd9Sstevel@tonic-gate }
2467c478bd9Sstevel@tonic-gate
2477c478bd9Sstevel@tonic-gate /*
2487c478bd9Sstevel@tonic-gate * Don't have to lock ipsec_age_interval, as only one thread will access it at
2497c478bd9Sstevel@tonic-gate * a time, because I control the one function that does a qtimeout() on
2507c478bd9Sstevel@tonic-gate * ah_pfkey_q.
2517c478bd9Sstevel@tonic-gate */
2527c478bd9Sstevel@tonic-gate static void
ah_ager(void * arg)253f4b3ec61Sdh ah_ager(void *arg)
2547c478bd9Sstevel@tonic-gate {
255f4b3ec61Sdh ipsecah_stack_t *ahstack = (ipsecah_stack_t *)arg;
256f4b3ec61Sdh netstack_t *ns = ahstack->ipsecah_netstack;
2577c478bd9Sstevel@tonic-gate hrtime_t begin = gethrtime();
2587c478bd9Sstevel@tonic-gate
259f4b3ec61Sdh sadb_ager(&ahstack->ah_sadb.s_v4, ahstack->ah_pfkey_q,
260bd670b35SErik Nordmark ahstack->ipsecah_reap_delay, ns);
261f4b3ec61Sdh sadb_ager(&ahstack->ah_sadb.s_v6, ahstack->ah_pfkey_q,
262bd670b35SErik Nordmark ahstack->ipsecah_reap_delay, ns);
2637c478bd9Sstevel@tonic-gate
264f4b3ec61Sdh ahstack->ah_event = sadb_retimeout(begin, ahstack->ah_pfkey_q,
265f4b3ec61Sdh ah_ager, ahstack,
266f4b3ec61Sdh &ahstack->ipsecah_age_interval, ahstack->ipsecah_age_int_max,
267f4b3ec61Sdh info.mi_idnum);
2687c478bd9Sstevel@tonic-gate }
2697c478bd9Sstevel@tonic-gate
2707c478bd9Sstevel@tonic-gate /*
2717c478bd9Sstevel@tonic-gate * Get an AH NDD parameter.
2727c478bd9Sstevel@tonic-gate */
2737c478bd9Sstevel@tonic-gate /* ARGSUSED */
2747c478bd9Sstevel@tonic-gate static int
ipsecah_param_get(queue_t * q,mblk_t * mp,caddr_t cp,cred_t * cr)27569e71331SBayard Bell ipsecah_param_get(
27669e71331SBayard Bell queue_t *q,
27769e71331SBayard Bell mblk_t *mp,
27869e71331SBayard Bell caddr_t cp,
27969e71331SBayard Bell cred_t *cr)
2807c478bd9Sstevel@tonic-gate {
2817c478bd9Sstevel@tonic-gate ipsecahparam_t *ipsecahpa = (ipsecahparam_t *)cp;
2827c478bd9Sstevel@tonic-gate uint_t value;
283f4b3ec61Sdh ipsecah_stack_t *ahstack = (ipsecah_stack_t *)q->q_ptr;
2847c478bd9Sstevel@tonic-gate
285f4b3ec61Sdh mutex_enter(&ahstack->ipsecah_param_lock);
2867c478bd9Sstevel@tonic-gate value = ipsecahpa->ipsecah_param_value;
287f4b3ec61Sdh mutex_exit(&ahstack->ipsecah_param_lock);
2887c478bd9Sstevel@tonic-gate
2897c478bd9Sstevel@tonic-gate (void) mi_mpprintf(mp, "%u", value);
2907c478bd9Sstevel@tonic-gate return (0);
2917c478bd9Sstevel@tonic-gate }
2927c478bd9Sstevel@tonic-gate
2937c478bd9Sstevel@tonic-gate /*
2947c478bd9Sstevel@tonic-gate * This routine sets an NDD variable in a ipsecahparam_t structure.
2957c478bd9Sstevel@tonic-gate */
2967c478bd9Sstevel@tonic-gate /* ARGSUSED */
2977c478bd9Sstevel@tonic-gate static int
ipsecah_param_set(queue_t * q,mblk_t * mp,char * value,caddr_t cp,cred_t * cr)29869e71331SBayard Bell ipsecah_param_set(
29969e71331SBayard Bell queue_t *q,
30069e71331SBayard Bell mblk_t *mp,
30169e71331SBayard Bell char *value,
30269e71331SBayard Bell caddr_t cp,
30369e71331SBayard Bell cred_t *cr)
3047c478bd9Sstevel@tonic-gate {
3057c478bd9Sstevel@tonic-gate ulong_t new_value;
3067c478bd9Sstevel@tonic-gate ipsecahparam_t *ipsecahpa = (ipsecahparam_t *)cp;
307f4b3ec61Sdh ipsecah_stack_t *ahstack = (ipsecah_stack_t *)q->q_ptr;
3087c478bd9Sstevel@tonic-gate
3097c478bd9Sstevel@tonic-gate /*
3107c478bd9Sstevel@tonic-gate * Fail the request if the new value does not lie within the
3117c478bd9Sstevel@tonic-gate * required bounds.
3127c478bd9Sstevel@tonic-gate */
3137c478bd9Sstevel@tonic-gate if (ddi_strtoul(value, NULL, 10, &new_value) != 0 ||
3147c478bd9Sstevel@tonic-gate new_value < ipsecahpa->ipsecah_param_min ||
3157c478bd9Sstevel@tonic-gate new_value > ipsecahpa->ipsecah_param_max) {
31669e71331SBayard Bell return (EINVAL);
3177c478bd9Sstevel@tonic-gate }
3187c478bd9Sstevel@tonic-gate
3197c478bd9Sstevel@tonic-gate /* Set the new value */
320f4b3ec61Sdh mutex_enter(&ahstack->ipsecah_param_lock);
3217c478bd9Sstevel@tonic-gate ipsecahpa->ipsecah_param_value = new_value;
322f4b3ec61Sdh mutex_exit(&ahstack->ipsecah_param_lock);
3237c478bd9Sstevel@tonic-gate return (0);
3247c478bd9Sstevel@tonic-gate }
3257c478bd9Sstevel@tonic-gate
3267c478bd9Sstevel@tonic-gate /*
3277c478bd9Sstevel@tonic-gate * Using lifetime NDD variables, fill in an extended combination's
3287c478bd9Sstevel@tonic-gate * lifetime information.
3297c478bd9Sstevel@tonic-gate */
3307c478bd9Sstevel@tonic-gate void
ipsecah_fill_defs(sadb_x_ecomb_t * ecomb,netstack_t * ns)331f4b3ec61Sdh ipsecah_fill_defs(sadb_x_ecomb_t *ecomb, netstack_t *ns)
3327c478bd9Sstevel@tonic-gate {
333f4b3ec61Sdh ipsecah_stack_t *ahstack = ns->netstack_ipsecah;
334f4b3ec61Sdh
335f4b3ec61Sdh ecomb->sadb_x_ecomb_soft_bytes = ahstack->ipsecah_default_soft_bytes;
336f4b3ec61Sdh ecomb->sadb_x_ecomb_hard_bytes = ahstack->ipsecah_default_hard_bytes;
337f4b3ec61Sdh ecomb->sadb_x_ecomb_soft_addtime =
338f4b3ec61Sdh ahstack->ipsecah_default_soft_addtime;
339f4b3ec61Sdh ecomb->sadb_x_ecomb_hard_addtime =
340f4b3ec61Sdh ahstack->ipsecah_default_hard_addtime;
341f4b3ec61Sdh ecomb->sadb_x_ecomb_soft_usetime =
342f4b3ec61Sdh ahstack->ipsecah_default_soft_usetime;
343f4b3ec61Sdh ecomb->sadb_x_ecomb_hard_usetime =
344f4b3ec61Sdh ahstack->ipsecah_default_hard_usetime;
3457c478bd9Sstevel@tonic-gate }
3467c478bd9Sstevel@tonic-gate
3477c478bd9Sstevel@tonic-gate /*
3487c478bd9Sstevel@tonic-gate * Initialize things for AH at module load time.
3497c478bd9Sstevel@tonic-gate */
3507c478bd9Sstevel@tonic-gate boolean_t
ipsecah_ddi_init(void)3517c478bd9Sstevel@tonic-gate ipsecah_ddi_init(void)
3527c478bd9Sstevel@tonic-gate {
353f4b3ec61Sdh ah_taskq = taskq_create("ah_taskq", 1, minclsyspri,
354f4b3ec61Sdh IPSEC_TASKQ_MIN, IPSEC_TASKQ_MAX, 0);
355f4b3ec61Sdh
356f4b3ec61Sdh /*
357f4b3ec61Sdh * We want to be informed each time a stack is created or
358f4b3ec61Sdh * destroyed in the kernel, so we can maintain the
359f4b3ec61Sdh * set of ipsecah_stack_t's.
360f4b3ec61Sdh */
361f4b3ec61Sdh netstack_register(NS_IPSECAH, ipsecah_stack_init, NULL,
362f4b3ec61Sdh ipsecah_stack_fini);
3637c478bd9Sstevel@tonic-gate
364f4b3ec61Sdh return (B_TRUE);
365f4b3ec61Sdh }
366f4b3ec61Sdh
367f4b3ec61Sdh /*
368f4b3ec61Sdh * Walk through the param array specified registering each element with the
369f4b3ec61Sdh * named dispatch handler.
370f4b3ec61Sdh */
371f4b3ec61Sdh static boolean_t
ipsecah_param_register(IDP * ndp,ipsecahparam_t * ahp,int cnt)372f4b3ec61Sdh ipsecah_param_register(IDP *ndp, ipsecahparam_t *ahp, int cnt)
373f4b3ec61Sdh {
374f4b3ec61Sdh for (; cnt-- > 0; ahp++) {
3757c478bd9Sstevel@tonic-gate if (ahp->ipsecah_param_name != NULL &&
3767c478bd9Sstevel@tonic-gate ahp->ipsecah_param_name[0]) {
377f4b3ec61Sdh if (!nd_load(ndp,
378f4b3ec61Sdh ahp->ipsecah_param_name,
3797c478bd9Sstevel@tonic-gate ipsecah_param_get, ipsecah_param_set,
3807c478bd9Sstevel@tonic-gate (caddr_t)ahp)) {
381f4b3ec61Sdh nd_free(ndp);
3827c478bd9Sstevel@tonic-gate return (B_FALSE);
3837c478bd9Sstevel@tonic-gate }
3847c478bd9Sstevel@tonic-gate }
3857c478bd9Sstevel@tonic-gate }
386f4b3ec61Sdh return (B_TRUE);
387f4b3ec61Sdh }
3887c478bd9Sstevel@tonic-gate
389f4b3ec61Sdh /*
390f4b3ec61Sdh * Initialize things for AH for each stack instance
391f4b3ec61Sdh */
392f4b3ec61Sdh static void *
ipsecah_stack_init(netstackid_t stackid,netstack_t * ns)393f4b3ec61Sdh ipsecah_stack_init(netstackid_t stackid, netstack_t *ns)
394f4b3ec61Sdh {
395f4b3ec61Sdh ipsecah_stack_t *ahstack;
396f4b3ec61Sdh ipsecahparam_t *ahp;
3977c478bd9Sstevel@tonic-gate
398f4b3ec61Sdh ahstack = (ipsecah_stack_t *)kmem_zalloc(sizeof (*ahstack), KM_SLEEP);
399f4b3ec61Sdh ahstack->ipsecah_netstack = ns;
4007c478bd9Sstevel@tonic-gate
401f4b3ec61Sdh ahp = (ipsecahparam_t *)kmem_alloc(sizeof (lcl_param_arr), KM_SLEEP);
402f4b3ec61Sdh ahstack->ipsecah_params = ahp;
403f4b3ec61Sdh bcopy(lcl_param_arr, ahp, sizeof (lcl_param_arr));
404fb87b5d2Ssommerfe
405f4b3ec61Sdh (void) ipsecah_param_register(&ahstack->ipsecah_g_nd, ahp,
406f4b3ec61Sdh A_CNT(lcl_param_arr));
4077c478bd9Sstevel@tonic-gate
408f4b3ec61Sdh (void) ah_kstat_init(ahstack, stackid);
4097c478bd9Sstevel@tonic-gate
410f4b3ec61Sdh ahstack->ah_sadb.s_acquire_timeout = &ahstack->ipsecah_acquire_timeout;
411f4b3ec61Sdh sadbp_init("AH", &ahstack->ah_sadb, SADB_SATYPE_AH, ah_hash_size,
412f4b3ec61Sdh ahstack->ipsecah_netstack);
4137c478bd9Sstevel@tonic-gate
414f4b3ec61Sdh mutex_init(&ahstack->ipsecah_param_lock, NULL, MUTEX_DEFAULT, 0);
415f4b3ec61Sdh
416f4b3ec61Sdh ip_drop_register(&ahstack->ah_dropper, "IPsec AH");
417f4b3ec61Sdh return (ahstack);
4187c478bd9Sstevel@tonic-gate }
4197c478bd9Sstevel@tonic-gate
4207c478bd9Sstevel@tonic-gate /*
4217c478bd9Sstevel@tonic-gate * Destroy things for AH at module unload time.
4227c478bd9Sstevel@tonic-gate */
4237c478bd9Sstevel@tonic-gate void
ipsecah_ddi_destroy(void)4247c478bd9Sstevel@tonic-gate ipsecah_ddi_destroy(void)
4257c478bd9Sstevel@tonic-gate {
426f4b3ec61Sdh netstack_unregister(NS_IPSECAH);
4277c478bd9Sstevel@tonic-gate taskq_destroy(ah_taskq);
428f4b3ec61Sdh }
4297c478bd9Sstevel@tonic-gate
430f4b3ec61Sdh /*
431f4b3ec61Sdh * Destroy things for AH for one stack... Never called?
432f4b3ec61Sdh */
433f4b3ec61Sdh static void
ipsecah_stack_fini(netstackid_t stackid,void * arg)434f4b3ec61Sdh ipsecah_stack_fini(netstackid_t stackid, void *arg)
435f4b3ec61Sdh {
436f4b3ec61Sdh ipsecah_stack_t *ahstack = (ipsecah_stack_t *)arg;
437f4b3ec61Sdh
438f4b3ec61Sdh if (ahstack->ah_pfkey_q != NULL) {
439f4b3ec61Sdh (void) quntimeout(ahstack->ah_pfkey_q, ahstack->ah_event);
440f4b3ec61Sdh }
441f4b3ec61Sdh ahstack->ah_sadb.s_acquire_timeout = NULL;
442f4b3ec61Sdh sadbp_destroy(&ahstack->ah_sadb, ahstack->ipsecah_netstack);
443f4b3ec61Sdh ip_drop_unregister(&ahstack->ah_dropper);
444f4b3ec61Sdh mutex_destroy(&ahstack->ipsecah_param_lock);
445f4b3ec61Sdh nd_free(&ahstack->ipsecah_g_nd);
446f4b3ec61Sdh
447f4b3ec61Sdh kmem_free(ahstack->ipsecah_params, sizeof (lcl_param_arr));
448f4b3ec61Sdh ahstack->ipsecah_params = NULL;
449f4b3ec61Sdh kstat_delete_netstack(ahstack->ah_ksp, stackid);
450f4b3ec61Sdh ahstack->ah_ksp = NULL;
451f4b3ec61Sdh ahstack->ah_kstats = NULL;
452f4b3ec61Sdh
453f4b3ec61Sdh kmem_free(ahstack, sizeof (*ahstack));
4547c478bd9Sstevel@tonic-gate }
4557c478bd9Sstevel@tonic-gate
4567c478bd9Sstevel@tonic-gate /*
457bd670b35SErik Nordmark * AH module open routine, which is here for keysock plumbing.
458bd670b35SErik Nordmark * Keysock is pushed over {AH,ESP} which is an artifact from the Bad Old
459bd670b35SErik Nordmark * Days of export control, and fears that ESP would not be allowed
460bd670b35SErik Nordmark * to be shipped at all by default. Eventually, keysock should
461bd670b35SErik Nordmark * either access AH and ESP via modstubs or krtld dependencies, or
462bd670b35SErik Nordmark * perhaps be folded in with AH and ESP into a single IPsec/netsec
463bd670b35SErik Nordmark * module ("netsec" if PF_KEY provides more than AH/ESP keying tables).
4647c478bd9Sstevel@tonic-gate */
4657c478bd9Sstevel@tonic-gate /* ARGSUSED */
4667c478bd9Sstevel@tonic-gate static int
ipsecah_open(queue_t * q,dev_t * devp,int flag,int sflag,cred_t * credp)4677c478bd9Sstevel@tonic-gate ipsecah_open(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp)
4687c478bd9Sstevel@tonic-gate {
469f4b3ec61Sdh netstack_t *ns;
470f4b3ec61Sdh ipsecah_stack_t *ahstack;
471f4b3ec61Sdh
472d2370ffeSsommerfe if (secpolicy_ip_config(credp, B_FALSE) != 0)
4737c478bd9Sstevel@tonic-gate return (EPERM);
4747c478bd9Sstevel@tonic-gate
4757c478bd9Sstevel@tonic-gate if (q->q_ptr != NULL)
4767c478bd9Sstevel@tonic-gate return (0); /* Re-open of an already open instance. */
4777c478bd9Sstevel@tonic-gate
4787c478bd9Sstevel@tonic-gate if (sflag != MODOPEN)
4797c478bd9Sstevel@tonic-gate return (EINVAL);
4807c478bd9Sstevel@tonic-gate
481f4b3ec61Sdh ns = netstack_find_by_cred(credp);
482f4b3ec61Sdh ASSERT(ns != NULL);
483f4b3ec61Sdh ahstack = ns->netstack_ipsecah;
484f4b3ec61Sdh ASSERT(ahstack != NULL);
485f4b3ec61Sdh
486f4b3ec61Sdh q->q_ptr = ahstack;
487f4b3ec61Sdh WR(q)->q_ptr = q->q_ptr;
4887c478bd9Sstevel@tonic-gate
489bd670b35SErik Nordmark qprocson(q);
4907c478bd9Sstevel@tonic-gate return (0);
4917c478bd9Sstevel@tonic-gate }
4927c478bd9Sstevel@tonic-gate
4937c478bd9Sstevel@tonic-gate /*
4947c478bd9Sstevel@tonic-gate * AH module close routine.
4957c478bd9Sstevel@tonic-gate */
4965e1743f0SToomas Soome /* ARGSUSED */
4977c478bd9Sstevel@tonic-gate static int
ipsecah_close(queue_t * q,int flags __unused,cred_t * credp __unused)4985e1743f0SToomas Soome ipsecah_close(queue_t *q, int flags __unused, cred_t *credp __unused)
4997c478bd9Sstevel@tonic-gate {
500f4b3ec61Sdh ipsecah_stack_t *ahstack = (ipsecah_stack_t *)q->q_ptr;
501f4b3ec61Sdh
5027c478bd9Sstevel@tonic-gate /*
5037c478bd9Sstevel@tonic-gate * Clean up q_ptr, if needed.
5047c478bd9Sstevel@tonic-gate */
5057c478bd9Sstevel@tonic-gate qprocsoff(q);
5067c478bd9Sstevel@tonic-gate
5077c478bd9Sstevel@tonic-gate /* Keysock queue check is safe, because of OCEXCL perimeter. */
5087c478bd9Sstevel@tonic-gate
509f4b3ec61Sdh if (q == ahstack->ah_pfkey_q) {
510f4b3ec61Sdh ah1dbg(ahstack,
511f4b3ec61Sdh ("ipsecah_close: Ummm... keysock is closing AH.\n"));
512f4b3ec61Sdh ahstack->ah_pfkey_q = NULL;
5137c478bd9Sstevel@tonic-gate /* Detach qtimeouts. */
514f4b3ec61Sdh (void) quntimeout(q, ahstack->ah_event);
5157c478bd9Sstevel@tonic-gate }
5167c478bd9Sstevel@tonic-gate
517f4b3ec61Sdh netstack_rele(ahstack->ipsecah_netstack);
5187c478bd9Sstevel@tonic-gate return (0);
5197c478bd9Sstevel@tonic-gate }
5207c478bd9Sstevel@tonic-gate
5217c478bd9Sstevel@tonic-gate /*
5227c478bd9Sstevel@tonic-gate * Construct an SADB_REGISTER message with the current algorithms.
5237c478bd9Sstevel@tonic-gate */
5247c478bd9Sstevel@tonic-gate static boolean_t
ah_register_out(uint32_t sequence,uint32_t pid,uint_t serial,ipsecah_stack_t * ahstack,cred_t * cr)525f4b3ec61Sdh ah_register_out(uint32_t sequence, uint32_t pid, uint_t serial,
526bd670b35SErik Nordmark ipsecah_stack_t *ahstack, cred_t *cr)
5277c478bd9Sstevel@tonic-gate {
5287c478bd9Sstevel@tonic-gate mblk_t *mp;
5297c478bd9Sstevel@tonic-gate boolean_t rc = B_TRUE;
5307c478bd9Sstevel@tonic-gate sadb_msg_t *samsg;
5317c478bd9Sstevel@tonic-gate sadb_supported_t *sasupp;
5327c478bd9Sstevel@tonic-gate sadb_alg_t *saalg;
5337c478bd9Sstevel@tonic-gate uint_t allocsize = sizeof (*samsg);
5347c478bd9Sstevel@tonic-gate uint_t i, numalgs_snap;
5357c478bd9Sstevel@tonic-gate ipsec_alginfo_t **authalgs;
5367c478bd9Sstevel@tonic-gate uint_t num_aalgs;
537f4b3ec61Sdh ipsec_stack_t *ipss = ahstack->ipsecah_netstack->netstack_ipsec;
5385d3b8cb7SBill Sommerfeld sadb_sens_t *sens;
5395d3b8cb7SBill Sommerfeld size_t sens_len = 0;
5405d3b8cb7SBill Sommerfeld sadb_ext_t *nextext;
541bd670b35SErik Nordmark ts_label_t *sens_tsl = NULL;
5427c478bd9Sstevel@tonic-gate
5437c478bd9Sstevel@tonic-gate /* Allocate the KEYSOCK_OUT. */
5447c478bd9Sstevel@tonic-gate mp = sadb_keysock_out(serial);
5457c478bd9Sstevel@tonic-gate if (mp == NULL) {
5467c478bd9Sstevel@tonic-gate ah0dbg(("ah_register_out: couldn't allocate mblk.\n"));
5477c478bd9Sstevel@tonic-gate return (B_FALSE);
5487c478bd9Sstevel@tonic-gate }
5497c478bd9Sstevel@tonic-gate
550bd670b35SErik Nordmark if (is_system_labeled() && (cr != NULL)) {
551bd670b35SErik Nordmark sens_tsl = crgetlabel(cr);
552bd670b35SErik Nordmark if (sens_tsl != NULL) {
553bd670b35SErik Nordmark sens_len = sadb_sens_len_from_label(sens_tsl);
5545d3b8cb7SBill Sommerfeld allocsize += sens_len;
5555d3b8cb7SBill Sommerfeld }
5565d3b8cb7SBill Sommerfeld }
5575d3b8cb7SBill Sommerfeld
5587c478bd9Sstevel@tonic-gate /*
5597c478bd9Sstevel@tonic-gate * Allocate the PF_KEY message that follows KEYSOCK_OUT.
5607c478bd9Sstevel@tonic-gate * The alg reader lock needs to be held while allocating
5617c478bd9Sstevel@tonic-gate * the variable part (i.e. the algorithms) of the message.
5627c478bd9Sstevel@tonic-gate */
5637c478bd9Sstevel@tonic-gate
56469e71331SBayard Bell rw_enter(&ipss->ipsec_alg_lock, RW_READER);
5657c478bd9Sstevel@tonic-gate
5667c478bd9Sstevel@tonic-gate /*
5677c478bd9Sstevel@tonic-gate * Return only valid algorithms, so the number of algorithms
5687c478bd9Sstevel@tonic-gate * to send up may be less than the number of algorithm entries
5697c478bd9Sstevel@tonic-gate * in the table.
5707c478bd9Sstevel@tonic-gate */
571f4b3ec61Sdh authalgs = ipss->ipsec_alglists[IPSEC_ALG_AUTH];
5727c478bd9Sstevel@tonic-gate for (num_aalgs = 0, i = 0; i < IPSEC_MAX_ALGS; i++)
5737c478bd9Sstevel@tonic-gate if (authalgs[i] != NULL && ALG_VALID(authalgs[i]))
5747c478bd9Sstevel@tonic-gate num_aalgs++;
5757c478bd9Sstevel@tonic-gate
5767c478bd9Sstevel@tonic-gate /*
5777c478bd9Sstevel@tonic-gate * Fill SADB_REGISTER message's algorithm descriptors. Hold
5787c478bd9Sstevel@tonic-gate * down the lock while filling it.
5797c478bd9Sstevel@tonic-gate */
5807c478bd9Sstevel@tonic-gate if (num_aalgs != 0) {
5817c478bd9Sstevel@tonic-gate allocsize += (num_aalgs * sizeof (*saalg));
5827c478bd9Sstevel@tonic-gate allocsize += sizeof (*sasupp);
5837c478bd9Sstevel@tonic-gate }
5847c478bd9Sstevel@tonic-gate mp->b_cont = allocb(allocsize, BPRI_HI);
5857c478bd9Sstevel@tonic-gate if (mp->b_cont == NULL) {
58669e71331SBayard Bell rw_exit(&ipss->ipsec_alg_lock);
5877c478bd9Sstevel@tonic-gate freemsg(mp);
5887c478bd9Sstevel@tonic-gate return (B_FALSE);
5897c478bd9Sstevel@tonic-gate }
5907c478bd9Sstevel@tonic-gate
5917c478bd9Sstevel@tonic-gate mp->b_cont->b_wptr += allocsize;
5925d3b8cb7SBill Sommerfeld nextext = (sadb_ext_t *)(mp->b_cont->b_rptr + sizeof (*samsg));
5935d3b8cb7SBill Sommerfeld
5947c478bd9Sstevel@tonic-gate if (num_aalgs != 0) {
5957c478bd9Sstevel@tonic-gate
5965d3b8cb7SBill Sommerfeld saalg = (sadb_alg_t *)(((uint8_t *)nextext) + sizeof (*sasupp));
5977c478bd9Sstevel@tonic-gate ASSERT(((ulong_t)saalg & 0x7) == 0);
5987c478bd9Sstevel@tonic-gate
5997c478bd9Sstevel@tonic-gate numalgs_snap = 0;
6007c478bd9Sstevel@tonic-gate for (i = 0;
601f4b3ec61Sdh ((i < IPSEC_MAX_ALGS) && (numalgs_snap < num_aalgs));
602f4b3ec61Sdh i++) {
6037c478bd9Sstevel@tonic-gate if (authalgs[i] == NULL || !ALG_VALID(authalgs[i]))
6047c478bd9Sstevel@tonic-gate continue;
6057c478bd9Sstevel@tonic-gate
6067c478bd9Sstevel@tonic-gate saalg->sadb_alg_id = authalgs[i]->alg_id;
6077c478bd9Sstevel@tonic-gate saalg->sadb_alg_ivlen = 0;
6087c478bd9Sstevel@tonic-gate saalg->sadb_alg_minbits = authalgs[i]->alg_ef_minbits;
6097c478bd9Sstevel@tonic-gate saalg->sadb_alg_maxbits = authalgs[i]->alg_ef_maxbits;
6107c478bd9Sstevel@tonic-gate saalg->sadb_x_alg_increment =
6117c478bd9Sstevel@tonic-gate authalgs[i]->alg_increment;
612628b0c67SMark Fenwick /* For now, salt is meaningless in AH. */
613628b0c67SMark Fenwick ASSERT(authalgs[i]->alg_saltlen == 0);
614628b0c67SMark Fenwick saalg->sadb_x_alg_saltbits =
615628b0c67SMark Fenwick SADB_8TO1(authalgs[i]->alg_saltlen);
6167c478bd9Sstevel@tonic-gate numalgs_snap++;
6177c478bd9Sstevel@tonic-gate saalg++;
6187c478bd9Sstevel@tonic-gate }
6197c478bd9Sstevel@tonic-gate ASSERT(numalgs_snap == num_aalgs);
6207c478bd9Sstevel@tonic-gate #ifdef DEBUG
6217c478bd9Sstevel@tonic-gate /*
6227c478bd9Sstevel@tonic-gate * Reality check to make sure I snagged all of the
6237c478bd9Sstevel@tonic-gate * algorithms.
6247c478bd9Sstevel@tonic-gate */
6257c478bd9Sstevel@tonic-gate for (; i < IPSEC_MAX_ALGS; i++)
6267c478bd9Sstevel@tonic-gate if (authalgs[i] != NULL && ALG_VALID(authalgs[i]))
6277c478bd9Sstevel@tonic-gate cmn_err(CE_PANIC,
6287c478bd9Sstevel@tonic-gate "ah_register_out()! Missed #%d.\n", i);
6297c478bd9Sstevel@tonic-gate #endif /* DEBUG */
6305d3b8cb7SBill Sommerfeld nextext = (sadb_ext_t *)saalg;
6317c478bd9Sstevel@tonic-gate }
6327c478bd9Sstevel@tonic-gate
63369e71331SBayard Bell rw_exit(&ipss->ipsec_alg_lock);
6347c478bd9Sstevel@tonic-gate
635bd670b35SErik Nordmark if (sens_tsl != NULL) {
6365d3b8cb7SBill Sommerfeld sens = (sadb_sens_t *)nextext;
637bd670b35SErik Nordmark sadb_sens_from_label(sens, SADB_EXT_SENSITIVITY,
638bd670b35SErik Nordmark sens_tsl, sens_len);
6395d3b8cb7SBill Sommerfeld
6405d3b8cb7SBill Sommerfeld nextext = (sadb_ext_t *)(((uint8_t *)sens) + sens_len);
6415d3b8cb7SBill Sommerfeld }
6425d3b8cb7SBill Sommerfeld
6437c478bd9Sstevel@tonic-gate /* Now fill the restof the SADB_REGISTER message. */
6447c478bd9Sstevel@tonic-gate
6457c478bd9Sstevel@tonic-gate samsg = (sadb_msg_t *)mp->b_cont->b_rptr;
6467c478bd9Sstevel@tonic-gate samsg->sadb_msg_version = PF_KEY_V2;
6477c478bd9Sstevel@tonic-gate samsg->sadb_msg_type = SADB_REGISTER;
6487c478bd9Sstevel@tonic-gate samsg->sadb_msg_errno = 0;
6497c478bd9Sstevel@tonic-gate samsg->sadb_msg_satype = SADB_SATYPE_AH;
6507c478bd9Sstevel@tonic-gate samsg->sadb_msg_len = SADB_8TO64(allocsize);
6517c478bd9Sstevel@tonic-gate samsg->sadb_msg_reserved = 0;
6527c478bd9Sstevel@tonic-gate /*
6537c478bd9Sstevel@tonic-gate * Assume caller has sufficient sequence/pid number info. If it's one
6547c478bd9Sstevel@tonic-gate * from me over a new alg., I could give two hoots about sequence.
6557c478bd9Sstevel@tonic-gate */
6567c478bd9Sstevel@tonic-gate samsg->sadb_msg_seq = sequence;
6577c478bd9Sstevel@tonic-gate samsg->sadb_msg_pid = pid;
6587c478bd9Sstevel@tonic-gate
6595d3b8cb7SBill Sommerfeld if (num_aalgs != 0) {
6607c478bd9Sstevel@tonic-gate sasupp = (sadb_supported_t *)(samsg + 1);
6615d3b8cb7SBill Sommerfeld sasupp->sadb_supported_len = SADB_8TO64(
6625d3b8cb7SBill Sommerfeld sizeof (*sasupp) + sizeof (*saalg) * num_aalgs);
6637c478bd9Sstevel@tonic-gate sasupp->sadb_supported_exttype = SADB_EXT_SUPPORTED_AUTH;
6647c478bd9Sstevel@tonic-gate sasupp->sadb_supported_reserved = 0;
6657c478bd9Sstevel@tonic-gate }
6667c478bd9Sstevel@tonic-gate
667f4b3ec61Sdh if (ahstack->ah_pfkey_q != NULL)
668f4b3ec61Sdh putnext(ahstack->ah_pfkey_q, mp);
6697c478bd9Sstevel@tonic-gate else {
6707c478bd9Sstevel@tonic-gate rc = B_FALSE;
6717c478bd9Sstevel@tonic-gate freemsg(mp);
6727c478bd9Sstevel@tonic-gate }
6737c478bd9Sstevel@tonic-gate
6747c478bd9Sstevel@tonic-gate return (rc);
6757c478bd9Sstevel@tonic-gate }
6767c478bd9Sstevel@tonic-gate
6777c478bd9Sstevel@tonic-gate /*
6787c478bd9Sstevel@tonic-gate * Invoked when the algorithm table changes. Causes SADB_REGISTER
6797c478bd9Sstevel@tonic-gate * messages continaining the current list of algorithms to be
6807c478bd9Sstevel@tonic-gate * sent up to the AH listeners.
6817c478bd9Sstevel@tonic-gate */
6827c478bd9Sstevel@tonic-gate void
ipsecah_algs_changed(netstack_t * ns)683f4b3ec61Sdh ipsecah_algs_changed(netstack_t *ns)
6847c478bd9Sstevel@tonic-gate {
685f4b3ec61Sdh ipsecah_stack_t *ahstack = ns->netstack_ipsecah;
686f4b3ec61Sdh
6877c478bd9Sstevel@tonic-gate /*
6887c478bd9Sstevel@tonic-gate * Time to send a PF_KEY SADB_REGISTER message to AH listeners
6897c478bd9Sstevel@tonic-gate * everywhere. (The function itself checks for NULL ah_pfkey_q.)
6907c478bd9Sstevel@tonic-gate */
6915d3b8cb7SBill Sommerfeld (void) ah_register_out(0, 0, 0, ahstack, NULL);
6927c478bd9Sstevel@tonic-gate }
6937c478bd9Sstevel@tonic-gate
6947c478bd9Sstevel@tonic-gate /*
6957c478bd9Sstevel@tonic-gate * Stub function that taskq_dispatch() invokes to take the mblk (in arg)
696bd670b35SErik Nordmark * and send it into AH and IP again.
6977c478bd9Sstevel@tonic-gate */
6987c478bd9Sstevel@tonic-gate static void
inbound_task(void * arg)6997c478bd9Sstevel@tonic-gate inbound_task(void *arg)
7007c478bd9Sstevel@tonic-gate {
701bd670b35SErik Nordmark mblk_t *mp = (mblk_t *)arg;
702bd670b35SErik Nordmark mblk_t *async_mp;
703bd670b35SErik Nordmark ip_recv_attr_t iras;
704bd670b35SErik Nordmark
705bd670b35SErik Nordmark async_mp = mp;
706bd670b35SErik Nordmark mp = async_mp->b_cont;
707bd670b35SErik Nordmark async_mp->b_cont = NULL;
708bd670b35SErik Nordmark if (!ip_recv_attr_from_mblk(async_mp, &iras)) {
709bd670b35SErik Nordmark /* The ill or ip_stack_t disappeared on us */
710bd670b35SErik Nordmark ip_drop_input("ip_recv_attr_from_mblk", mp, NULL);
71173184bc7SDan McDonald freemsg(mp);
712bd670b35SErik Nordmark goto done;
71373184bc7SDan McDonald }
71473184bc7SDan McDonald
715bd670b35SErik Nordmark ah_inbound_restart(mp, &iras);
716bd670b35SErik Nordmark done:
717bd670b35SErik Nordmark ira_cleanup(&iras, B_TRUE);
718bd670b35SErik Nordmark }
719bd670b35SErik Nordmark
720bd670b35SErik Nordmark /*
721bd670b35SErik Nordmark * Restart ESP after the SA has been added.
722bd670b35SErik Nordmark */
723bd670b35SErik Nordmark static void
ah_inbound_restart(mblk_t * mp,ip_recv_attr_t * ira)724bd670b35SErik Nordmark ah_inbound_restart(mblk_t *mp, ip_recv_attr_t *ira)
725bd670b35SErik Nordmark {
726bd670b35SErik Nordmark ah_t *ah;
727bd670b35SErik Nordmark netstack_t *ns;
728bd670b35SErik Nordmark ipsecah_stack_t *ahstack;
7297c478bd9Sstevel@tonic-gate
730bd670b35SErik Nordmark ns = ira->ira_ill->ill_ipst->ips_netstack;
731bd670b35SErik Nordmark ahstack = ns->netstack_ipsecah;
7327c478bd9Sstevel@tonic-gate
733f4b3ec61Sdh ASSERT(ahstack != NULL);
734bd670b35SErik Nordmark mp = ipsec_inbound_ah_sa(mp, ira, &ah);
735bd670b35SErik Nordmark if (mp == NULL)
736bd670b35SErik Nordmark return;
737bd670b35SErik Nordmark
738bd670b35SErik Nordmark ASSERT(ah != NULL);
739bd670b35SErik Nordmark ASSERT(ira->ira_flags & IRAF_IPSEC_SECURE);
740bd670b35SErik Nordmark ASSERT(ira->ira_ipsec_ah_sa != NULL);
741bd670b35SErik Nordmark
742bd670b35SErik Nordmark mp = ira->ira_ipsec_ah_sa->ipsa_input_func(mp, ah, ira);
743bd670b35SErik Nordmark if (mp == NULL) {
744bd670b35SErik Nordmark /*
745bd670b35SErik Nordmark * Either it failed or is pending. In the former case
746bd670b35SErik Nordmark * ipIfStatsInDiscards was increased.
747bd670b35SErik Nordmark */
748bd670b35SErik Nordmark return;
74973184bc7SDan McDonald }
750bd670b35SErik Nordmark ip_input_post_ipsec(mp, ira);
7517c478bd9Sstevel@tonic-gate }
7527c478bd9Sstevel@tonic-gate
7537c478bd9Sstevel@tonic-gate /*
7547c478bd9Sstevel@tonic-gate * Now that weak-key passed, actually ADD the security association, and
7557c478bd9Sstevel@tonic-gate * send back a reply ADD message.
7567c478bd9Sstevel@tonic-gate */
7577c478bd9Sstevel@tonic-gate static int
ah_add_sa_finish(mblk_t * mp,sadb_msg_t * samsg,keysock_in_t * ksi,int * diagnostic,ipsecah_stack_t * ahstack)7588810c16bSdanmcd ah_add_sa_finish(mblk_t *mp, sadb_msg_t *samsg, keysock_in_t *ksi,
759f4b3ec61Sdh int *diagnostic, ipsecah_stack_t *ahstack)
7607c478bd9Sstevel@tonic-gate {
7615d3b8cb7SBill Sommerfeld isaf_t *primary = NULL, *secondary;
7625d3b8cb7SBill Sommerfeld boolean_t clone = B_FALSE, is_inbound = B_FALSE;
7637c478bd9Sstevel@tonic-gate sadb_sa_t *assoc = (sadb_sa_t *)ksi->ks_in_extv[SADB_EXT_SA];
7647c478bd9Sstevel@tonic-gate ipsa_t *larval;
7657c478bd9Sstevel@tonic-gate ipsacq_t *acqrec;
7667c478bd9Sstevel@tonic-gate iacqf_t *acq_bucket;
7677c478bd9Sstevel@tonic-gate mblk_t *acq_msgs = NULL;
7687c478bd9Sstevel@tonic-gate mblk_t *lpkt;
7697c478bd9Sstevel@tonic-gate int rc;
7705d3b8cb7SBill Sommerfeld ipsa_query_t sq;
7715d3b8cb7SBill Sommerfeld int error;
772f4b3ec61Sdh netstack_t *ns = ahstack->ipsecah_netstack;
773f4b3ec61Sdh ipsec_stack_t *ipss = ns->netstack_ipsec;
7747c478bd9Sstevel@tonic-gate
7757c478bd9Sstevel@tonic-gate /*
7767c478bd9Sstevel@tonic-gate * Locate the appropriate table(s).
7777c478bd9Sstevel@tonic-gate */
7787c478bd9Sstevel@tonic-gate
7795d3b8cb7SBill Sommerfeld sq.spp = &ahstack->ah_sadb;
7805d3b8cb7SBill Sommerfeld error = sadb_form_query(ksi, IPSA_Q_SA|IPSA_Q_DST,
7815d3b8cb7SBill Sommerfeld IPSA_Q_SA|IPSA_Q_DST|IPSA_Q_INBOUND|IPSA_Q_OUTBOUND,
7825d3b8cb7SBill Sommerfeld &sq, diagnostic);
7835d3b8cb7SBill Sommerfeld if (error)
7845d3b8cb7SBill Sommerfeld return (error);
7857c478bd9Sstevel@tonic-gate
78638d95a78Smarkfen /*
78738d95a78Smarkfen * Use the direction flags provided by the KMD to determine
78838d95a78Smarkfen * if the inbound or outbound table should be the primary
78938d95a78Smarkfen * for this SA. If these flags were absent then make this
79038d95a78Smarkfen * decision based on the addresses.
79138d95a78Smarkfen */
79238d95a78Smarkfen if (assoc->sadb_sa_flags & IPSA_F_INBOUND) {
7935d3b8cb7SBill Sommerfeld primary = sq.inbound;
7945d3b8cb7SBill Sommerfeld secondary = sq.outbound;
79538d95a78Smarkfen is_inbound = B_TRUE;
79638d95a78Smarkfen if (assoc->sadb_sa_flags & IPSA_F_OUTBOUND)
79738d95a78Smarkfen clone = B_TRUE;
79838d95a78Smarkfen } else {
79938d95a78Smarkfen if (assoc->sadb_sa_flags & IPSA_F_OUTBOUND) {
8005d3b8cb7SBill Sommerfeld primary = sq.outbound;
8015d3b8cb7SBill Sommerfeld secondary = sq.inbound;
80238d95a78Smarkfen }
80338d95a78Smarkfen }
80438d95a78Smarkfen if (primary == NULL) {
80538d95a78Smarkfen /*
80638d95a78Smarkfen * The KMD did not set a direction flag, determine which
80738d95a78Smarkfen * table to insert the SA into based on addresses.
80838d95a78Smarkfen */
80938d95a78Smarkfen switch (ksi->ks_in_dsttype) {
81038d95a78Smarkfen case KS_IN_ADDR_MBCAST:
81138d95a78Smarkfen clone = B_TRUE; /* All mcast SAs can be bidirectional */
81238d95a78Smarkfen assoc->sadb_sa_flags |= IPSA_F_OUTBOUND;
81338d95a78Smarkfen /* FALLTHRU */
8147c478bd9Sstevel@tonic-gate /*
8157c478bd9Sstevel@tonic-gate * If the source address is either one of mine, or unspecified
8167c478bd9Sstevel@tonic-gate * (which is best summed up by saying "not 'not mine'"),
8177c478bd9Sstevel@tonic-gate * then the association is potentially bi-directional,
8187c478bd9Sstevel@tonic-gate * in that it can be used for inbound traffic and outbound
8197c478bd9Sstevel@tonic-gate * traffic. The best example of such and SA is a multicast
8207c478bd9Sstevel@tonic-gate * SA (which allows me to receive the outbound traffic).
8217c478bd9Sstevel@tonic-gate */
82238d95a78Smarkfen case KS_IN_ADDR_ME:
82338d95a78Smarkfen assoc->sadb_sa_flags |= IPSA_F_INBOUND;
8245d3b8cb7SBill Sommerfeld primary = sq.inbound;
8255d3b8cb7SBill Sommerfeld secondary = sq.outbound;
82638d95a78Smarkfen if (ksi->ks_in_srctype != KS_IN_ADDR_NOTME)
82738d95a78Smarkfen clone = B_TRUE;
82838d95a78Smarkfen is_inbound = B_TRUE;
82938d95a78Smarkfen break;
8305d3b8cb7SBill Sommerfeld
8317c478bd9Sstevel@tonic-gate /*
8327c478bd9Sstevel@tonic-gate * If the source address literally not mine (either
8337c478bd9Sstevel@tonic-gate * unspecified or not mine), then this SA may have an
8347c478bd9Sstevel@tonic-gate * address that WILL be mine after some configuration.
8357c478bd9Sstevel@tonic-gate * We pay the price for this by making it a bi-directional
8367c478bd9Sstevel@tonic-gate * SA.
8377c478bd9Sstevel@tonic-gate */
83838d95a78Smarkfen case KS_IN_ADDR_NOTME:
83938d95a78Smarkfen assoc->sadb_sa_flags |= IPSA_F_OUTBOUND;
8405d3b8cb7SBill Sommerfeld primary = sq.outbound;
8415d3b8cb7SBill Sommerfeld secondary = sq.inbound;
84238d95a78Smarkfen if (ksi->ks_in_srctype != KS_IN_ADDR_ME) {
84338d95a78Smarkfen assoc->sadb_sa_flags |= IPSA_F_INBOUND;
84438d95a78Smarkfen clone = B_TRUE;
84538d95a78Smarkfen }
84638d95a78Smarkfen break;
84738d95a78Smarkfen default:
84838d95a78Smarkfen *diagnostic = SADB_X_DIAGNOSTIC_BAD_DST;
84938d95a78Smarkfen return (EINVAL);
85038d95a78Smarkfen }
8517c478bd9Sstevel@tonic-gate }
8527c478bd9Sstevel@tonic-gate
8537c478bd9Sstevel@tonic-gate /*
8547c478bd9Sstevel@tonic-gate * Find a ACQUIRE list entry if possible. If we've added an SA that
8557c478bd9Sstevel@tonic-gate * suits the needs of an ACQUIRE list entry, we can eliminate the
8567c478bd9Sstevel@tonic-gate * ACQUIRE list entry and transmit the enqueued packets. Use the
8577c478bd9Sstevel@tonic-gate * high-bit of the sequence number to queue it. Key off destination
8587c478bd9Sstevel@tonic-gate * addr, and change acqrec's state.
8597c478bd9Sstevel@tonic-gate */
8607c478bd9Sstevel@tonic-gate
8617c478bd9Sstevel@tonic-gate if (samsg->sadb_msg_seq & IACQF_LOWEST_SEQ) {
8625d3b8cb7SBill Sommerfeld acq_bucket = &(sq.sp->sdb_acq[sq.outhash]);
8637c478bd9Sstevel@tonic-gate mutex_enter(&acq_bucket->iacqf_lock);
8647c478bd9Sstevel@tonic-gate for (acqrec = acq_bucket->iacqf_ipsacq; acqrec != NULL;
8657c478bd9Sstevel@tonic-gate acqrec = acqrec->ipsacq_next) {
8667c478bd9Sstevel@tonic-gate mutex_enter(&acqrec->ipsacq_lock);
8677c478bd9Sstevel@tonic-gate /*
8687c478bd9Sstevel@tonic-gate * Q: I only check sequence. Should I check dst?
8697c478bd9Sstevel@tonic-gate * A: Yes, check dest because those are the packets
8707c478bd9Sstevel@tonic-gate * that are queued up.
8717c478bd9Sstevel@tonic-gate */
8727c478bd9Sstevel@tonic-gate if (acqrec->ipsacq_seq == samsg->sadb_msg_seq &&
8735d3b8cb7SBill Sommerfeld IPSA_ARE_ADDR_EQUAL(sq.dstaddr,
874437220cdSdanmcd acqrec->ipsacq_dstaddr, acqrec->ipsacq_addrfam))
8757c478bd9Sstevel@tonic-gate break;
8767c478bd9Sstevel@tonic-gate mutex_exit(&acqrec->ipsacq_lock);
8777c478bd9Sstevel@tonic-gate }
8787c478bd9Sstevel@tonic-gate if (acqrec != NULL) {
8797c478bd9Sstevel@tonic-gate /*
8807c478bd9Sstevel@tonic-gate * AHA! I found an ACQUIRE record for this SA.
8817c478bd9Sstevel@tonic-gate * Grab the msg list, and free the acquire record.
8827c478bd9Sstevel@tonic-gate * I already am holding the lock for this record,
8837c478bd9Sstevel@tonic-gate * so all I have to do is free it.
8847c478bd9Sstevel@tonic-gate */
8857c478bd9Sstevel@tonic-gate acq_msgs = acqrec->ipsacq_mp;
8867c478bd9Sstevel@tonic-gate acqrec->ipsacq_mp = NULL;
8877c478bd9Sstevel@tonic-gate mutex_exit(&acqrec->ipsacq_lock);
888f4b3ec61Sdh sadb_destroy_acquire(acqrec, ns);
8897c478bd9Sstevel@tonic-gate }
8907c478bd9Sstevel@tonic-gate mutex_exit(&acq_bucket->iacqf_lock);
8917c478bd9Sstevel@tonic-gate }
8927c478bd9Sstevel@tonic-gate
8937c478bd9Sstevel@tonic-gate /*
8947c478bd9Sstevel@tonic-gate * Find PF_KEY message, and see if I'm an update. If so, find entry
8957c478bd9Sstevel@tonic-gate * in larval list (if there).
8967c478bd9Sstevel@tonic-gate */
8977c478bd9Sstevel@tonic-gate
8987c478bd9Sstevel@tonic-gate larval = NULL;
8997c478bd9Sstevel@tonic-gate
9007c478bd9Sstevel@tonic-gate if (samsg->sadb_msg_type == SADB_UPDATE) {
9015d3b8cb7SBill Sommerfeld mutex_enter(&sq.inbound->isaf_lock);
9025d3b8cb7SBill Sommerfeld larval = ipsec_getassocbyspi(sq.inbound, sq.assoc->sadb_sa_spi,
9035d3b8cb7SBill Sommerfeld ALL_ZEROES_PTR, sq.dstaddr, sq.dst->sin_family);
9045d3b8cb7SBill Sommerfeld mutex_exit(&sq.inbound->isaf_lock);
9057c478bd9Sstevel@tonic-gate
9067c478bd9Sstevel@tonic-gate if ((larval == NULL) ||
9077c478bd9Sstevel@tonic-gate (larval->ipsa_state != IPSA_STATE_LARVAL)) {
90838d95a78Smarkfen *diagnostic = SADB_X_DIAGNOSTIC_SA_NOTFOUND;
90972bd9b6bSdanmcd if (larval != NULL) {
91072bd9b6bSdanmcd IPSA_REFRELE(larval);
91172bd9b6bSdanmcd }
9127c478bd9Sstevel@tonic-gate ah0dbg(("Larval update, but larval disappeared.\n"));
9137c478bd9Sstevel@tonic-gate return (ESRCH);
9147c478bd9Sstevel@tonic-gate } /* Else sadb_common_add unlinks it for me! */
9157c478bd9Sstevel@tonic-gate }
9167c478bd9Sstevel@tonic-gate
917930af642SDan McDonald if (larval != NULL) {
918930af642SDan McDonald /*
919930af642SDan McDonald * Hold again, because sadb_common_add() consumes a reference,
920930af642SDan McDonald * and we don't want to clear_lpkt() without a reference.
921930af642SDan McDonald */
922930af642SDan McDonald IPSA_REFHOLD(larval);
923930af642SDan McDonald }
9247c478bd9Sstevel@tonic-gate
925bd670b35SErik Nordmark rc = sadb_common_add(ahstack->ah_pfkey_q, mp,
926f4b3ec61Sdh samsg, ksi, primary, secondary, larval, clone, is_inbound,
92738d95a78Smarkfen diagnostic, ns, &ahstack->ah_sadb);
9287c478bd9Sstevel@tonic-gate
929930af642SDan McDonald if (larval != NULL) {
930bd670b35SErik Nordmark if (rc == 0) {
931930af642SDan McDonald lpkt = sadb_clear_lpkt(larval);
932930af642SDan McDonald if (lpkt != NULL) {
933fc8ae2ecSToomas Soome rc = taskq_dispatch(ah_taskq, inbound_task,
934fc8ae2ecSToomas Soome lpkt, TQ_NOSLEEP) == TASKQID_INVALID;
935930af642SDan McDonald }
936bd670b35SErik Nordmark }
937930af642SDan McDonald IPSA_REFRELE(larval);
938bd670b35SErik Nordmark }
939bd670b35SErik Nordmark
9407c478bd9Sstevel@tonic-gate /*
9417c478bd9Sstevel@tonic-gate * How much more stack will I create with all of these
942bd670b35SErik Nordmark * ah_outbound_*() calls?
9437c478bd9Sstevel@tonic-gate */
9447c478bd9Sstevel@tonic-gate
945bd670b35SErik Nordmark /* Handle the packets queued waiting for the SA */
9467c478bd9Sstevel@tonic-gate while (acq_msgs != NULL) {
947bd670b35SErik Nordmark mblk_t *asyncmp;
948bd670b35SErik Nordmark mblk_t *data_mp;
949bd670b35SErik Nordmark ip_xmit_attr_t ixas;
950bd670b35SErik Nordmark ill_t *ill;
9517c478bd9Sstevel@tonic-gate
952bd670b35SErik Nordmark asyncmp = acq_msgs;
9537c478bd9Sstevel@tonic-gate acq_msgs = acq_msgs->b_next;
954bd670b35SErik Nordmark asyncmp->b_next = NULL;
955bd670b35SErik Nordmark
956bd670b35SErik Nordmark /*
957bd670b35SErik Nordmark * Extract the ip_xmit_attr_t from the first mblk.
958bd670b35SErik Nordmark * Verifies that the netstack and ill is still around; could
959bd670b35SErik Nordmark * have vanished while iked was doing its work.
960bd670b35SErik Nordmark * On succesful return we have a nce_t and the ill/ipst can't
961bd670b35SErik Nordmark * disappear until we do the nce_refrele in ixa_cleanup.
962bd670b35SErik Nordmark */
963bd670b35SErik Nordmark data_mp = asyncmp->b_cont;
964bd670b35SErik Nordmark asyncmp->b_cont = NULL;
965bd670b35SErik Nordmark if (!ip_xmit_attr_from_mblk(asyncmp, &ixas)) {
966bd670b35SErik Nordmark AH_BUMP_STAT(ahstack, out_discards);
967bd670b35SErik Nordmark ip_drop_packet(data_mp, B_FALSE, NULL,
968bd670b35SErik Nordmark DROPPER(ipss, ipds_sadb_acquire_timeout),
969bd670b35SErik Nordmark &ahstack->ah_dropper);
970bd670b35SErik Nordmark } else if (rc != 0) {
971bd670b35SErik Nordmark ill = ixas.ixa_nce->nce_ill;
972bd670b35SErik Nordmark AH_BUMP_STAT(ahstack, out_discards);
973bd670b35SErik Nordmark ip_drop_packet(data_mp, B_FALSE, ill,
974bd670b35SErik Nordmark DROPPER(ipss, ipds_sadb_acquire_timeout),
975bd670b35SErik Nordmark &ahstack->ah_dropper);
976bd670b35SErik Nordmark BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
977bd670b35SErik Nordmark } else {
978bd670b35SErik Nordmark ah_outbound_finish(data_mp, &ixas);
9797c478bd9Sstevel@tonic-gate }
980bd670b35SErik Nordmark ixa_cleanup(&ixas);
981bd670b35SErik Nordmark }
982bd670b35SErik Nordmark
983bd670b35SErik Nordmark return (rc);
984bd670b35SErik Nordmark }
985bd670b35SErik Nordmark
986bd670b35SErik Nordmark
987bd670b35SErik Nordmark /*
988bd670b35SErik Nordmark * Process one of the queued messages (from ipsacq_mp) once the SA
989bd670b35SErik Nordmark * has been added.
990bd670b35SErik Nordmark */
991bd670b35SErik Nordmark static void
ah_outbound_finish(mblk_t * data_mp,ip_xmit_attr_t * ixa)992bd670b35SErik Nordmark ah_outbound_finish(mblk_t *data_mp, ip_xmit_attr_t *ixa)
993bd670b35SErik Nordmark {
994bd670b35SErik Nordmark netstack_t *ns = ixa->ixa_ipst->ips_netstack;
995bd670b35SErik Nordmark ipsecah_stack_t *ahstack = ns->netstack_ipsecah;
996bd670b35SErik Nordmark ipsec_stack_t *ipss = ns->netstack_ipsec;
997bd670b35SErik Nordmark ill_t *ill = ixa->ixa_nce->nce_ill;
998bd670b35SErik Nordmark
999bd670b35SErik Nordmark if (!ipsec_outbound_sa(data_mp, ixa, IPPROTO_AH)) {
1000f4b3ec61Sdh AH_BUMP_STAT(ahstack, out_discards);
1001bd670b35SErik Nordmark ip_drop_packet(data_mp, B_FALSE, ill,
1002f4b3ec61Sdh DROPPER(ipss, ipds_sadb_acquire_timeout),
1003f4b3ec61Sdh &ahstack->ah_dropper);
1004bd670b35SErik Nordmark BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
1005bd670b35SErik Nordmark return;
10067c478bd9Sstevel@tonic-gate }
10077c478bd9Sstevel@tonic-gate
1008bd670b35SErik Nordmark data_mp = ah_outbound(data_mp, ixa);
1009bd670b35SErik Nordmark if (data_mp == NULL)
1010bd670b35SErik Nordmark return;
1011bd670b35SErik Nordmark
1012bd670b35SErik Nordmark (void) ip_output_post_ipsec(data_mp, ixa);
10137c478bd9Sstevel@tonic-gate }
10147c478bd9Sstevel@tonic-gate
10157c478bd9Sstevel@tonic-gate /*
10167c478bd9Sstevel@tonic-gate * Add new AH security association. This may become a generic AH/ESP
10177c478bd9Sstevel@tonic-gate * routine eventually.
10187c478bd9Sstevel@tonic-gate */
10197c478bd9Sstevel@tonic-gate static int
ah_add_sa(mblk_t * mp,keysock_in_t * ksi,int * diagnostic,netstack_t * ns)1020f4b3ec61Sdh ah_add_sa(mblk_t *mp, keysock_in_t *ksi, int *diagnostic, netstack_t *ns)
10217c478bd9Sstevel@tonic-gate {
10227c478bd9Sstevel@tonic-gate sadb_sa_t *assoc = (sadb_sa_t *)ksi->ks_in_extv[SADB_EXT_SA];
10237c478bd9Sstevel@tonic-gate sadb_address_t *srcext =
10247c478bd9Sstevel@tonic-gate (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_SRC];
10257c478bd9Sstevel@tonic-gate sadb_address_t *dstext =
10267c478bd9Sstevel@tonic-gate (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_DST];
10278810c16bSdanmcd sadb_address_t *isrcext =
10288810c16bSdanmcd (sadb_address_t *)ksi->ks_in_extv[SADB_X_EXT_ADDRESS_INNER_SRC];
10298810c16bSdanmcd sadb_address_t *idstext =
10308810c16bSdanmcd (sadb_address_t *)ksi->ks_in_extv[SADB_X_EXT_ADDRESS_INNER_DST];
10317c478bd9Sstevel@tonic-gate sadb_key_t *key = (sadb_key_t *)ksi->ks_in_extv[SADB_EXT_KEY_AUTH];
10327c478bd9Sstevel@tonic-gate struct sockaddr_in *src, *dst;
10337c478bd9Sstevel@tonic-gate /* We don't need sockaddr_in6 for now. */
10347c478bd9Sstevel@tonic-gate sadb_lifetime_t *soft =
10357c478bd9Sstevel@tonic-gate (sadb_lifetime_t *)ksi->ks_in_extv[SADB_EXT_LIFETIME_SOFT];
10367c478bd9Sstevel@tonic-gate sadb_lifetime_t *hard =
10377c478bd9Sstevel@tonic-gate (sadb_lifetime_t *)ksi->ks_in_extv[SADB_EXT_LIFETIME_HARD];
10389c2c14abSThejaswini Singarajipura sadb_lifetime_t *idle =
10399c2c14abSThejaswini Singarajipura (sadb_lifetime_t *)ksi->ks_in_extv[SADB_X_EXT_LIFETIME_IDLE];
10407c478bd9Sstevel@tonic-gate ipsec_alginfo_t *aalg;
1041f4b3ec61Sdh ipsecah_stack_t *ahstack = ns->netstack_ipsecah;
1042f4b3ec61Sdh ipsec_stack_t *ipss = ns->netstack_ipsec;
10437c478bd9Sstevel@tonic-gate
10447c478bd9Sstevel@tonic-gate /* I need certain extensions present for an ADD message. */
10457c478bd9Sstevel@tonic-gate if (srcext == NULL) {
10467c478bd9Sstevel@tonic-gate *diagnostic = SADB_X_DIAGNOSTIC_MISSING_SRC;
10477c478bd9Sstevel@tonic-gate return (EINVAL);
10487c478bd9Sstevel@tonic-gate }
10497c478bd9Sstevel@tonic-gate if (dstext == NULL) {
10507c478bd9Sstevel@tonic-gate *diagnostic = SADB_X_DIAGNOSTIC_MISSING_DST;
10517c478bd9Sstevel@tonic-gate return (EINVAL);
10527c478bd9Sstevel@tonic-gate }
10538810c16bSdanmcd if (isrcext == NULL && idstext != NULL) {
10548810c16bSdanmcd *diagnostic = SADB_X_DIAGNOSTIC_MISSING_INNER_SRC;
10558810c16bSdanmcd return (EINVAL);
10568810c16bSdanmcd }
10578810c16bSdanmcd if (isrcext != NULL && idstext == NULL) {
10588810c16bSdanmcd *diagnostic = SADB_X_DIAGNOSTIC_MISSING_INNER_DST;
10598810c16bSdanmcd return (EINVAL);
10608810c16bSdanmcd }
10617c478bd9Sstevel@tonic-gate if (assoc == NULL) {
10627c478bd9Sstevel@tonic-gate *diagnostic = SADB_X_DIAGNOSTIC_MISSING_SA;
10637c478bd9Sstevel@tonic-gate return (EINVAL);
10647c478bd9Sstevel@tonic-gate }
10657c478bd9Sstevel@tonic-gate if (key == NULL) {
10667c478bd9Sstevel@tonic-gate *diagnostic = SADB_X_DIAGNOSTIC_MISSING_AKEY;
10677c478bd9Sstevel@tonic-gate return (EINVAL);
10687c478bd9Sstevel@tonic-gate }
10697c478bd9Sstevel@tonic-gate
10707c478bd9Sstevel@tonic-gate src = (struct sockaddr_in *)(srcext + 1);
10717c478bd9Sstevel@tonic-gate dst = (struct sockaddr_in *)(dstext + 1);
10727c478bd9Sstevel@tonic-gate
10737c478bd9Sstevel@tonic-gate /* Sundry ADD-specific reality checks. */
10747c478bd9Sstevel@tonic-gate /* XXX STATS : Logging/stats here? */
10757c478bd9Sstevel@tonic-gate
10769c2c14abSThejaswini Singarajipura if ((assoc->sadb_sa_state != SADB_SASTATE_MATURE) &&
10779c2c14abSThejaswini Singarajipura (assoc->sadb_sa_state != SADB_X_SASTATE_ACTIVE_ELSEWHERE)) {
10787c478bd9Sstevel@tonic-gate *diagnostic = SADB_X_DIAGNOSTIC_BAD_SASTATE;
10797c478bd9Sstevel@tonic-gate return (EINVAL);
10807c478bd9Sstevel@tonic-gate }
10817c478bd9Sstevel@tonic-gate if (assoc->sadb_sa_encrypt != SADB_EALG_NONE) {
10827c478bd9Sstevel@tonic-gate *diagnostic = SADB_X_DIAGNOSTIC_ENCR_NOTSUPP;
10837c478bd9Sstevel@tonic-gate return (EINVAL);
10847c478bd9Sstevel@tonic-gate }
108572bd9b6bSdanmcd if (assoc->sadb_sa_flags & ~ahstack->ah_sadb.s_addflags) {
10867c478bd9Sstevel@tonic-gate *diagnostic = SADB_X_DIAGNOSTIC_BAD_SAFLAGS;
10877c478bd9Sstevel@tonic-gate return (EINVAL);
10887c478bd9Sstevel@tonic-gate }
10899c2c14abSThejaswini Singarajipura if ((*diagnostic = sadb_hardsoftchk(hard, soft, idle)) != 0)
10907c478bd9Sstevel@tonic-gate return (EINVAL);
10917c478bd9Sstevel@tonic-gate
10928810c16bSdanmcd ASSERT(src->sin_family == dst->sin_family);
10937c478bd9Sstevel@tonic-gate
10947c478bd9Sstevel@tonic-gate /* Stuff I don't support, for now. XXX Diagnostic? */
10955d3b8cb7SBill Sommerfeld if (ksi->ks_in_extv[SADB_EXT_LIFETIME_CURRENT] != NULL)
10967c478bd9Sstevel@tonic-gate return (EOPNOTSUPP);
10977c478bd9Sstevel@tonic-gate
10985d3b8cb7SBill Sommerfeld if (ksi->ks_in_extv[SADB_EXT_SENSITIVITY] != NULL) {
10995d3b8cb7SBill Sommerfeld if (!is_system_labeled())
11005d3b8cb7SBill Sommerfeld return (EOPNOTSUPP);
11015d3b8cb7SBill Sommerfeld }
11025d3b8cb7SBill Sommerfeld
11035d3b8cb7SBill Sommerfeld if (ksi->ks_in_extv[SADB_X_EXT_OUTER_SENS] != NULL) {
11045d3b8cb7SBill Sommerfeld if (!is_system_labeled())
11055d3b8cb7SBill Sommerfeld return (EOPNOTSUPP);
11065d3b8cb7SBill Sommerfeld }
11077c478bd9Sstevel@tonic-gate /*
11085d3b8cb7SBill Sommerfeld * XXX Policy : I'm not checking identities at this time, but
11095d3b8cb7SBill Sommerfeld * if I did, I'd do them here, before I sent the weak key
11105d3b8cb7SBill Sommerfeld * check up to the algorithm.
11117c478bd9Sstevel@tonic-gate */
11127c478bd9Sstevel@tonic-gate
11137c478bd9Sstevel@tonic-gate /* verify that there is a mapping for the specified algorithm */
111469e71331SBayard Bell rw_enter(&ipss->ipsec_alg_lock, RW_READER);
1115f4b3ec61Sdh aalg = ipss->ipsec_alglists[IPSEC_ALG_AUTH][assoc->sadb_sa_auth];
11167c478bd9Sstevel@tonic-gate if (aalg == NULL || !ALG_VALID(aalg)) {
111769e71331SBayard Bell rw_exit(&ipss->ipsec_alg_lock);
1118f4b3ec61Sdh ah1dbg(ahstack, ("Couldn't find auth alg #%d.\n",
1119437220cdSdanmcd assoc->sadb_sa_auth));
11207c478bd9Sstevel@tonic-gate *diagnostic = SADB_X_DIAGNOSTIC_BAD_AALG;
11217c478bd9Sstevel@tonic-gate return (EINVAL);
11227c478bd9Sstevel@tonic-gate }
11237c478bd9Sstevel@tonic-gate ASSERT(aalg->alg_mech_type != CRYPTO_MECHANISM_INVALID);
11247c478bd9Sstevel@tonic-gate
11257c478bd9Sstevel@tonic-gate /* sanity check key sizes */
11267c478bd9Sstevel@tonic-gate if (!ipsec_valid_key_size(key->sadb_key_bits, aalg)) {
112769e71331SBayard Bell rw_exit(&ipss->ipsec_alg_lock);
11287c478bd9Sstevel@tonic-gate *diagnostic = SADB_X_DIAGNOSTIC_BAD_AKEYBITS;
11297c478bd9Sstevel@tonic-gate return (EINVAL);
11307c478bd9Sstevel@tonic-gate }
11317c478bd9Sstevel@tonic-gate
11327c478bd9Sstevel@tonic-gate /* check key and fix parity if needed */
11337c478bd9Sstevel@tonic-gate if (ipsec_check_key(aalg->alg_mech_type, key, B_TRUE,
11347c478bd9Sstevel@tonic-gate diagnostic) != 0) {
113569e71331SBayard Bell rw_exit(&ipss->ipsec_alg_lock);
11367c478bd9Sstevel@tonic-gate return (EINVAL);
11377c478bd9Sstevel@tonic-gate }
11387c478bd9Sstevel@tonic-gate
113969e71331SBayard Bell rw_exit(&ipss->ipsec_alg_lock);
11407c478bd9Sstevel@tonic-gate
11418810c16bSdanmcd return (ah_add_sa_finish(mp, (sadb_msg_t *)mp->b_cont->b_rptr, ksi,
1142437220cdSdanmcd diagnostic, ahstack));
11437c478bd9Sstevel@tonic-gate }
11447c478bd9Sstevel@tonic-gate
11455d3b8cb7SBill Sommerfeld /* Refactor me */
11467c478bd9Sstevel@tonic-gate /*
11477c478bd9Sstevel@tonic-gate * Update a security association. Updates come in two varieties. The first
11487c478bd9Sstevel@tonic-gate * is an update of lifetimes on a non-larval SA. The second is an update of
11497c478bd9Sstevel@tonic-gate * a larval SA, which ends up looking a lot more like an add.
11507c478bd9Sstevel@tonic-gate */
11517c478bd9Sstevel@tonic-gate static int
ah_update_sa(mblk_t * mp,keysock_in_t * ksi,int * diagnostic,ipsecah_stack_t * ahstack,uint8_t sadb_msg_type)1152f4b3ec61Sdh ah_update_sa(mblk_t *mp, keysock_in_t *ksi, int *diagnostic,
115338d95a78Smarkfen ipsecah_stack_t *ahstack, uint8_t sadb_msg_type)
11547c478bd9Sstevel@tonic-gate {
11559c2c14abSThejaswini Singarajipura sadb_sa_t *assoc = (sadb_sa_t *)ksi->ks_in_extv[SADB_EXT_SA];
11567c478bd9Sstevel@tonic-gate sadb_address_t *dstext =
11577c478bd9Sstevel@tonic-gate (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_DST];
11589c2c14abSThejaswini Singarajipura mblk_t *buf_pkt;
11599c2c14abSThejaswini Singarajipura int rcode;
11607c478bd9Sstevel@tonic-gate
11617c478bd9Sstevel@tonic-gate if (dstext == NULL) {
11627c478bd9Sstevel@tonic-gate *diagnostic = SADB_X_DIAGNOSTIC_MISSING_DST;
11637c478bd9Sstevel@tonic-gate return (EINVAL);
11647c478bd9Sstevel@tonic-gate }
11659c2c14abSThejaswini Singarajipura
11669c2c14abSThejaswini Singarajipura rcode = sadb_update_sa(mp, ksi, &buf_pkt, &ahstack->ah_sadb,
11679c2c14abSThejaswini Singarajipura diagnostic, ahstack->ah_pfkey_q, ah_add_sa,
11689c2c14abSThejaswini Singarajipura ahstack->ipsecah_netstack, sadb_msg_type);
11699c2c14abSThejaswini Singarajipura
11709c2c14abSThejaswini Singarajipura if ((assoc->sadb_sa_state != SADB_X_SASTATE_ACTIVE) ||
11719c2c14abSThejaswini Singarajipura (rcode != 0)) {
11729c2c14abSThejaswini Singarajipura return (rcode);
11739c2c14abSThejaswini Singarajipura }
11749c2c14abSThejaswini Singarajipura
117573184bc7SDan McDonald HANDLE_BUF_PKT(ah_taskq, ahstack->ipsecah_netstack->netstack_ipsec,
117673184bc7SDan McDonald ahstack->ah_dropper, buf_pkt);
11779c2c14abSThejaswini Singarajipura
11789c2c14abSThejaswini Singarajipura return (rcode);
11797c478bd9Sstevel@tonic-gate }
11807c478bd9Sstevel@tonic-gate
11815d3b8cb7SBill Sommerfeld /* Refactor me */
11827c478bd9Sstevel@tonic-gate /*
11837c478bd9Sstevel@tonic-gate * Delete a security association. This is REALLY likely to be code common to
11847c478bd9Sstevel@tonic-gate * both AH and ESP. Find the association, then unlink it.
11857c478bd9Sstevel@tonic-gate */
11867c478bd9Sstevel@tonic-gate static int
ah_del_sa(mblk_t * mp,keysock_in_t * ksi,int * diagnostic,ipsecah_stack_t * ahstack,uint8_t sadb_msg_type)1187f4b3ec61Sdh ah_del_sa(mblk_t *mp, keysock_in_t *ksi, int *diagnostic,
118838d95a78Smarkfen ipsecah_stack_t *ahstack, uint8_t sadb_msg_type)
11897c478bd9Sstevel@tonic-gate {
11907c478bd9Sstevel@tonic-gate sadb_sa_t *assoc = (sadb_sa_t *)ksi->ks_in_extv[SADB_EXT_SA];
11917c478bd9Sstevel@tonic-gate sadb_address_t *dstext =
11927c478bd9Sstevel@tonic-gate (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_DST];
11937c478bd9Sstevel@tonic-gate sadb_address_t *srcext =
11947c478bd9Sstevel@tonic-gate (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_SRC];
11957c478bd9Sstevel@tonic-gate struct sockaddr_in *sin;
11967c478bd9Sstevel@tonic-gate
11977c478bd9Sstevel@tonic-gate if (assoc == NULL) {
11987c478bd9Sstevel@tonic-gate if (dstext != NULL)
11997c478bd9Sstevel@tonic-gate sin = (struct sockaddr_in *)(dstext + 1);
12007c478bd9Sstevel@tonic-gate else if (srcext != NULL)
12017c478bd9Sstevel@tonic-gate sin = (struct sockaddr_in *)(srcext + 1);
12027c478bd9Sstevel@tonic-gate else {
12037c478bd9Sstevel@tonic-gate *diagnostic = SADB_X_DIAGNOSTIC_MISSING_SA;
12047c478bd9Sstevel@tonic-gate return (EINVAL);
12057c478bd9Sstevel@tonic-gate }
12068810c16bSdanmcd return (sadb_purge_sa(mp, ksi,
1207f4b3ec61Sdh (sin->sin_family == AF_INET6) ? &ahstack->ah_sadb.s_v6 :
1208bd670b35SErik Nordmark &ahstack->ah_sadb.s_v4, diagnostic, ahstack->ah_pfkey_q));
12097c478bd9Sstevel@tonic-gate }
12107c478bd9Sstevel@tonic-gate
121138d95a78Smarkfen return (sadb_delget_sa(mp, ksi, &ahstack->ah_sadb, diagnostic,
121238d95a78Smarkfen ahstack->ah_pfkey_q, sadb_msg_type));
12137c478bd9Sstevel@tonic-gate }
12147c478bd9Sstevel@tonic-gate
12155d3b8cb7SBill Sommerfeld /* Refactor me */
12167c478bd9Sstevel@tonic-gate /*
12177c478bd9Sstevel@tonic-gate * Convert the entire contents of all of AH's SA tables into PF_KEY SADB_DUMP
12187c478bd9Sstevel@tonic-gate * messages.
12197c478bd9Sstevel@tonic-gate */
12207c478bd9Sstevel@tonic-gate static void
ah_dump(mblk_t * mp,keysock_in_t * ksi,ipsecah_stack_t * ahstack)1221f4b3ec61Sdh ah_dump(mblk_t *mp, keysock_in_t *ksi, ipsecah_stack_t *ahstack)
12227c478bd9Sstevel@tonic-gate {
12237c478bd9Sstevel@tonic-gate int error;
12247c478bd9Sstevel@tonic-gate sadb_msg_t *samsg;
12257c478bd9Sstevel@tonic-gate
12267c478bd9Sstevel@tonic-gate /*
12277c478bd9Sstevel@tonic-gate * Dump each fanout, bailing if error is non-zero.
12287c478bd9Sstevel@tonic-gate */
12297c478bd9Sstevel@tonic-gate
12309c2c14abSThejaswini Singarajipura error = sadb_dump(ahstack->ah_pfkey_q, mp, ksi, &ahstack->ah_sadb.s_v4);
12317c478bd9Sstevel@tonic-gate if (error != 0)
12327c478bd9Sstevel@tonic-gate goto bail;
12337c478bd9Sstevel@tonic-gate
12349c2c14abSThejaswini Singarajipura error = sadb_dump(ahstack->ah_pfkey_q, mp, ksi, &ahstack->ah_sadb.s_v6);
12357c478bd9Sstevel@tonic-gate bail:
12367c478bd9Sstevel@tonic-gate ASSERT(mp->b_cont != NULL);
12377c478bd9Sstevel@tonic-gate samsg = (sadb_msg_t *)mp->b_cont->b_rptr;
12387c478bd9Sstevel@tonic-gate samsg->sadb_msg_errno = (uint8_t)error;
1239f4b3ec61Sdh sadb_pfkey_echo(ahstack->ah_pfkey_q, mp,
1240f4b3ec61Sdh (sadb_msg_t *)mp->b_cont->b_rptr, ksi, NULL);
12417c478bd9Sstevel@tonic-gate }
12427c478bd9Sstevel@tonic-gate
12438810c16bSdanmcd /*
12448810c16bSdanmcd * First-cut reality check for an inbound PF_KEY message.
12458810c16bSdanmcd */
12468810c16bSdanmcd static boolean_t
ah_pfkey_reality_failures(mblk_t * mp,keysock_in_t * ksi,ipsecah_stack_t * ahstack)1247f4b3ec61Sdh ah_pfkey_reality_failures(mblk_t *mp, keysock_in_t *ksi,
1248f4b3ec61Sdh ipsecah_stack_t *ahstack)
12498810c16bSdanmcd {
12508810c16bSdanmcd int diagnostic;
12518810c16bSdanmcd
12528810c16bSdanmcd if (mp->b_cont == NULL) {
12538810c16bSdanmcd freemsg(mp);
12548810c16bSdanmcd return (B_TRUE);
12558810c16bSdanmcd }
12568810c16bSdanmcd
12578810c16bSdanmcd if (ksi->ks_in_extv[SADB_EXT_KEY_ENCRYPT] != NULL) {
12588810c16bSdanmcd diagnostic = SADB_X_DIAGNOSTIC_EKEY_PRESENT;
12598810c16bSdanmcd goto badmsg;
12608810c16bSdanmcd }
12618810c16bSdanmcd if (ksi->ks_in_extv[SADB_EXT_PROPOSAL] != NULL) {
12628810c16bSdanmcd diagnostic = SADB_X_DIAGNOSTIC_PROP_PRESENT;
12638810c16bSdanmcd goto badmsg;
12648810c16bSdanmcd }
12658810c16bSdanmcd if (ksi->ks_in_extv[SADB_EXT_SUPPORTED_AUTH] != NULL ||
12668810c16bSdanmcd ksi->ks_in_extv[SADB_EXT_SUPPORTED_ENCRYPT] != NULL) {
12678810c16bSdanmcd diagnostic = SADB_X_DIAGNOSTIC_SUPP_PRESENT;
12688810c16bSdanmcd goto badmsg;
12698810c16bSdanmcd }
12708810c16bSdanmcd return (B_FALSE); /* False ==> no failures */
12718810c16bSdanmcd
12728810c16bSdanmcd badmsg:
1273f4b3ec61Sdh sadb_pfkey_error(ahstack->ah_pfkey_q, mp, EINVAL,
1274f4b3ec61Sdh diagnostic, ksi->ks_in_serial);
12758810c16bSdanmcd return (B_TRUE); /* True ==> failures */
12768810c16bSdanmcd }
12778810c16bSdanmcd
12787c478bd9Sstevel@tonic-gate /*
12797c478bd9Sstevel@tonic-gate * AH parsing of PF_KEY messages. Keysock did most of the really silly
12807c478bd9Sstevel@tonic-gate * error cases. What I receive is a fully-formed, syntactically legal
12817c478bd9Sstevel@tonic-gate * PF_KEY message. I then need to check semantics...
12827c478bd9Sstevel@tonic-gate *
12837c478bd9Sstevel@tonic-gate * This code may become common to AH and ESP. Stay tuned.
12847c478bd9Sstevel@tonic-gate *
12857c478bd9Sstevel@tonic-gate * I also make the assumption that db_ref's are cool. If this assumption
12867c478bd9Sstevel@tonic-gate * is wrong, this means that someone other than keysock or me has been
12877c478bd9Sstevel@tonic-gate * mucking with PF_KEY messages.
12887c478bd9Sstevel@tonic-gate */
12897c478bd9Sstevel@tonic-gate static void
ah_parse_pfkey(mblk_t * mp,ipsecah_stack_t * ahstack)1290f4b3ec61Sdh ah_parse_pfkey(mblk_t *mp, ipsecah_stack_t *ahstack)
12917c478bd9Sstevel@tonic-gate {
12927c478bd9Sstevel@tonic-gate mblk_t *msg = mp->b_cont;
12937c478bd9Sstevel@tonic-gate sadb_msg_t *samsg;
12947c478bd9Sstevel@tonic-gate keysock_in_t *ksi;
12957c478bd9Sstevel@tonic-gate int error;
12967c478bd9Sstevel@tonic-gate int diagnostic = SADB_X_DIAGNOSTIC_NONE;
12977c478bd9Sstevel@tonic-gate
12987c478bd9Sstevel@tonic-gate ASSERT(msg != NULL);
1299f4b3ec61Sdh
13007c478bd9Sstevel@tonic-gate samsg = (sadb_msg_t *)msg->b_rptr;
13017c478bd9Sstevel@tonic-gate ksi = (keysock_in_t *)mp->b_rptr;
13027c478bd9Sstevel@tonic-gate
13037c478bd9Sstevel@tonic-gate /*
13047c478bd9Sstevel@tonic-gate * If applicable, convert unspecified AF_INET6 to unspecified
13057c478bd9Sstevel@tonic-gate * AF_INET.
13067c478bd9Sstevel@tonic-gate */
1307f4b3ec61Sdh if (!sadb_addrfix(ksi, ahstack->ah_pfkey_q, mp,
1308f4b3ec61Sdh ahstack->ipsecah_netstack) ||
1309f4b3ec61Sdh ah_pfkey_reality_failures(mp, ksi, ahstack)) {
13108810c16bSdanmcd return;
13118810c16bSdanmcd }
13127c478bd9Sstevel@tonic-gate
13137c478bd9Sstevel@tonic-gate switch (samsg->sadb_msg_type) {
13147c478bd9Sstevel@tonic-gate case SADB_ADD:
1315f4b3ec61Sdh error = ah_add_sa(mp, ksi, &diagnostic,
1316f4b3ec61Sdh ahstack->ipsecah_netstack);
13177c478bd9Sstevel@tonic-gate if (error != 0) {
1318f4b3ec61Sdh sadb_pfkey_error(ahstack->ah_pfkey_q, mp, error,
1319f4b3ec61Sdh diagnostic, ksi->ks_in_serial);
13207c478bd9Sstevel@tonic-gate }
13217c478bd9Sstevel@tonic-gate /* else ah_add_sa() took care of things. */
13227c478bd9Sstevel@tonic-gate break;
13237c478bd9Sstevel@tonic-gate case SADB_DELETE:
132438d95a78Smarkfen case SADB_X_DELPAIR:
13259c2c14abSThejaswini Singarajipura case SADB_X_DELPAIR_STATE:
132638d95a78Smarkfen error = ah_del_sa(mp, ksi, &diagnostic, ahstack,
132738d95a78Smarkfen samsg->sadb_msg_type);
13287c478bd9Sstevel@tonic-gate if (error != 0) {
1329f4b3ec61Sdh sadb_pfkey_error(ahstack->ah_pfkey_q, mp, error,
1330f4b3ec61Sdh diagnostic, ksi->ks_in_serial);
13317c478bd9Sstevel@tonic-gate }
13327c478bd9Sstevel@tonic-gate /* Else ah_del_sa() took care of things. */
13337c478bd9Sstevel@tonic-gate break;
13347c478bd9Sstevel@tonic-gate case SADB_GET:
133538d95a78Smarkfen error = sadb_delget_sa(mp, ksi, &ahstack->ah_sadb, &diagnostic,
133638d95a78Smarkfen ahstack->ah_pfkey_q, samsg->sadb_msg_type);
13377c478bd9Sstevel@tonic-gate if (error != 0) {
1338f4b3ec61Sdh sadb_pfkey_error(ahstack->ah_pfkey_q, mp, error,
1339f4b3ec61Sdh diagnostic, ksi->ks_in_serial);
13407c478bd9Sstevel@tonic-gate }
13417c478bd9Sstevel@tonic-gate /* Else sadb_get_sa() took care of things. */
13427c478bd9Sstevel@tonic-gate break;
13437c478bd9Sstevel@tonic-gate case SADB_FLUSH:
1344f4b3ec61Sdh sadbp_flush(&ahstack->ah_sadb, ahstack->ipsecah_netstack);
1345f4b3ec61Sdh sadb_pfkey_echo(ahstack->ah_pfkey_q, mp, samsg, ksi, NULL);
13467c478bd9Sstevel@tonic-gate break;
13477c478bd9Sstevel@tonic-gate case SADB_REGISTER:
13487c478bd9Sstevel@tonic-gate /*
13497c478bd9Sstevel@tonic-gate * Hmmm, let's do it! Check for extensions (there should
13507c478bd9Sstevel@tonic-gate * be none), extract the fields, call ah_register_out(),
13517c478bd9Sstevel@tonic-gate * then either free or report an error.
13527c478bd9Sstevel@tonic-gate *
13537c478bd9Sstevel@tonic-gate * Keysock takes care of the PF_KEY bookkeeping for this.
13547c478bd9Sstevel@tonic-gate */
13557c478bd9Sstevel@tonic-gate if (ah_register_out(samsg->sadb_msg_seq, samsg->sadb_msg_pid,
1356bd670b35SErik Nordmark ksi->ks_in_serial, ahstack, msg_getcred(mp, NULL))) {
13577c478bd9Sstevel@tonic-gate freemsg(mp);
13587c478bd9Sstevel@tonic-gate } else {
13597c478bd9Sstevel@tonic-gate /*
13607c478bd9Sstevel@tonic-gate * Only way this path hits is if there is a memory
13617c478bd9Sstevel@tonic-gate * failure. It will not return B_FALSE because of
13627c478bd9Sstevel@tonic-gate * lack of ah_pfkey_q if I am in wput().
13637c478bd9Sstevel@tonic-gate */
1364f4b3ec61Sdh sadb_pfkey_error(ahstack->ah_pfkey_q, mp, ENOMEM,
1365f4b3ec61Sdh diagnostic, ksi->ks_in_serial);
13667c478bd9Sstevel@tonic-gate }
13677c478bd9Sstevel@tonic-gate break;
13687c478bd9Sstevel@tonic-gate case SADB_UPDATE:
136938d95a78Smarkfen case SADB_X_UPDATEPAIR:
13707c478bd9Sstevel@tonic-gate /*
13717c478bd9Sstevel@tonic-gate * Find a larval, if not there, find a full one and get
13727c478bd9Sstevel@tonic-gate * strict.
13737c478bd9Sstevel@tonic-gate */
137438d95a78Smarkfen error = ah_update_sa(mp, ksi, &diagnostic, ahstack,
137538d95a78Smarkfen samsg->sadb_msg_type);
13767c478bd9Sstevel@tonic-gate if (error != 0) {
1377f4b3ec61Sdh sadb_pfkey_error(ahstack->ah_pfkey_q, mp, error,
1378f4b3ec61Sdh diagnostic, ksi->ks_in_serial);
13797c478bd9Sstevel@tonic-gate }
13807c478bd9Sstevel@tonic-gate /* else ah_update_sa() took care of things. */
13817c478bd9Sstevel@tonic-gate break;
13827c478bd9Sstevel@tonic-gate case SADB_GETSPI:
13837c478bd9Sstevel@tonic-gate /*
13847c478bd9Sstevel@tonic-gate * Reserve a new larval entry.
13857c478bd9Sstevel@tonic-gate */
1386f4b3ec61Sdh ah_getspi(mp, ksi, ahstack);
13877c478bd9Sstevel@tonic-gate break;
13887c478bd9Sstevel@tonic-gate case SADB_ACQUIRE:
13897c478bd9Sstevel@tonic-gate /*
13907c478bd9Sstevel@tonic-gate * Find larval and/or ACQUIRE record and kill it (them), I'm
13917c478bd9Sstevel@tonic-gate * most likely an error. Inbound ACQUIRE messages should only
13927c478bd9Sstevel@tonic-gate * have the base header.
13937c478bd9Sstevel@tonic-gate */
1394f4b3ec61Sdh sadb_in_acquire(samsg, &ahstack->ah_sadb, ahstack->ah_pfkey_q,
1395f4b3ec61Sdh ahstack->ipsecah_netstack);
13967c478bd9Sstevel@tonic-gate freemsg(mp);
13977c478bd9Sstevel@tonic-gate break;
13987c478bd9Sstevel@tonic-gate case SADB_DUMP:
13997c478bd9Sstevel@tonic-gate /*
14007c478bd9Sstevel@tonic-gate * Dump all entries.
14017c478bd9Sstevel@tonic-gate */
1402f4b3ec61Sdh ah_dump(mp, ksi, ahstack);
14037c478bd9Sstevel@tonic-gate /* ah_dump will take care of the return message, etc. */
14047c478bd9Sstevel@tonic-gate break;
14057c478bd9Sstevel@tonic-gate case SADB_EXPIRE:
14067c478bd9Sstevel@tonic-gate /* Should never reach me. */
1407f4b3ec61Sdh sadb_pfkey_error(ahstack->ah_pfkey_q, mp, EOPNOTSUPP,
1408f4b3ec61Sdh diagnostic, ksi->ks_in_serial);
14097c478bd9Sstevel@tonic-gate break;
14107c478bd9Sstevel@tonic-gate default:
1411f4b3ec61Sdh sadb_pfkey_error(ahstack->ah_pfkey_q, mp, EINVAL,
14127c478bd9Sstevel@tonic-gate SADB_X_DIAGNOSTIC_UNKNOWN_MSG, ksi->ks_in_serial);
14137c478bd9Sstevel@tonic-gate break;
14147c478bd9Sstevel@tonic-gate }
14157c478bd9Sstevel@tonic-gate }
14167c478bd9Sstevel@tonic-gate
14177c478bd9Sstevel@tonic-gate /*
14187c478bd9Sstevel@tonic-gate * Handle case where PF_KEY says it can't find a keysock for one of my
14197c478bd9Sstevel@tonic-gate * ACQUIRE messages.
14207c478bd9Sstevel@tonic-gate */
14217c478bd9Sstevel@tonic-gate static void
ah_keysock_no_socket(mblk_t * mp,ipsecah_stack_t * ahstack)1422f4b3ec61Sdh ah_keysock_no_socket(mblk_t *mp, ipsecah_stack_t *ahstack)
14237c478bd9Sstevel@tonic-gate {
14247c478bd9Sstevel@tonic-gate sadb_msg_t *samsg;
14257c478bd9Sstevel@tonic-gate keysock_out_err_t *kse = (keysock_out_err_t *)mp->b_rptr;
14267c478bd9Sstevel@tonic-gate
14277c478bd9Sstevel@tonic-gate if (mp->b_cont == NULL) {
14287c478bd9Sstevel@tonic-gate freemsg(mp);
14297c478bd9Sstevel@tonic-gate return;
14307c478bd9Sstevel@tonic-gate }
14317c478bd9Sstevel@tonic-gate samsg = (sadb_msg_t *)mp->b_cont->b_rptr;
14327c478bd9Sstevel@tonic-gate
14337c478bd9Sstevel@tonic-gate /*
14347c478bd9Sstevel@tonic-gate * If keysock can't find any registered, delete the acquire record
14357c478bd9Sstevel@tonic-gate * immediately, and handle errors.
14367c478bd9Sstevel@tonic-gate */
14377c478bd9Sstevel@tonic-gate if (samsg->sadb_msg_type == SADB_ACQUIRE) {
14387c478bd9Sstevel@tonic-gate samsg->sadb_msg_errno = kse->ks_err_errno;
14397c478bd9Sstevel@tonic-gate samsg->sadb_msg_len = SADB_8TO64(sizeof (*samsg));
14407c478bd9Sstevel@tonic-gate /*
1441bd670b35SErik Nordmark * Use the write-side of the ah_pfkey_q
14427c478bd9Sstevel@tonic-gate */
1443f4b3ec61Sdh sadb_in_acquire(samsg, &ahstack->ah_sadb,
1444f4b3ec61Sdh WR(ahstack->ah_pfkey_q), ahstack->ipsecah_netstack);
14457c478bd9Sstevel@tonic-gate }
14467c478bd9Sstevel@tonic-gate
14477c478bd9Sstevel@tonic-gate freemsg(mp);
14487c478bd9Sstevel@tonic-gate }
14497c478bd9Sstevel@tonic-gate
1450d81c80caSToomas Soome /*
1451d81c80caSToomas Soome * AH module read put routine.
1452d81c80caSToomas Soome */
1453d81c80caSToomas Soome static int
ipsecah_rput(queue_t * q,mblk_t * mp)1454d81c80caSToomas Soome ipsecah_rput(queue_t *q, mblk_t *mp)
1455d81c80caSToomas Soome {
1456d81c80caSToomas Soome putnext(q, mp);
1457d81c80caSToomas Soome return (0);
1458d81c80caSToomas Soome }
1459d81c80caSToomas Soome
14607c478bd9Sstevel@tonic-gate /*
14617c478bd9Sstevel@tonic-gate * AH module write put routine.
14627c478bd9Sstevel@tonic-gate */
1463d81c80caSToomas Soome static int
ipsecah_wput(queue_t * q,mblk_t * mp)14647c478bd9Sstevel@tonic-gate ipsecah_wput(queue_t *q, mblk_t *mp)
14657c478bd9Sstevel@tonic-gate {
14667c478bd9Sstevel@tonic-gate ipsec_info_t *ii;
14677c478bd9Sstevel@tonic-gate struct iocblk *iocp;
1468f4b3ec61Sdh ipsecah_stack_t *ahstack = (ipsecah_stack_t *)q->q_ptr;
14697c478bd9Sstevel@tonic-gate
1470f4b3ec61Sdh ah3dbg(ahstack, ("In ah_wput().\n"));
14717c478bd9Sstevel@tonic-gate
14727c478bd9Sstevel@tonic-gate /* NOTE: Each case must take care of freeing or passing mp. */
14737c478bd9Sstevel@tonic-gate switch (mp->b_datap->db_type) {
14747c478bd9Sstevel@tonic-gate case M_CTL:
14757c478bd9Sstevel@tonic-gate if ((mp->b_wptr - mp->b_rptr) < sizeof (ipsec_info_t)) {
14767c478bd9Sstevel@tonic-gate /* Not big enough message. */
14777c478bd9Sstevel@tonic-gate freemsg(mp);
14787c478bd9Sstevel@tonic-gate break;
14797c478bd9Sstevel@tonic-gate }
14807c478bd9Sstevel@tonic-gate ii = (ipsec_info_t *)mp->b_rptr;
14817c478bd9Sstevel@tonic-gate
14827c478bd9Sstevel@tonic-gate switch (ii->ipsec_info_type) {
14837c478bd9Sstevel@tonic-gate case KEYSOCK_OUT_ERR:
1484f4b3ec61Sdh ah1dbg(ahstack, ("Got KEYSOCK_OUT_ERR message.\n"));
1485f4b3ec61Sdh ah_keysock_no_socket(mp, ahstack);
14867c478bd9Sstevel@tonic-gate break;
14877c478bd9Sstevel@tonic-gate case KEYSOCK_IN:
1488f4b3ec61Sdh AH_BUMP_STAT(ahstack, keysock_in);
1489f4b3ec61Sdh ah3dbg(ahstack, ("Got KEYSOCK_IN message.\n"));
14907c478bd9Sstevel@tonic-gate
14918810c16bSdanmcd /* Parse the message. */
1492f4b3ec61Sdh ah_parse_pfkey(mp, ahstack);
14937c478bd9Sstevel@tonic-gate break;
14947c478bd9Sstevel@tonic-gate case KEYSOCK_HELLO:
1495f4b3ec61Sdh sadb_keysock_hello(&ahstack->ah_pfkey_q, q, mp,
1496f4b3ec61Sdh ah_ager, (void *)ahstack, &ahstack->ah_event,
1497f4b3ec61Sdh SADB_SATYPE_AH);
14987c478bd9Sstevel@tonic-gate break;
14997c478bd9Sstevel@tonic-gate default:
1500f4b3ec61Sdh ah1dbg(ahstack, ("Got M_CTL from above of 0x%x.\n",
15017c478bd9Sstevel@tonic-gate ii->ipsec_info_type));
15027c478bd9Sstevel@tonic-gate freemsg(mp);
15037c478bd9Sstevel@tonic-gate break;
15047c478bd9Sstevel@tonic-gate }
15057c478bd9Sstevel@tonic-gate break;
15067c478bd9Sstevel@tonic-gate case M_IOCTL:
15077c478bd9Sstevel@tonic-gate iocp = (struct iocblk *)mp->b_rptr;
15087c478bd9Sstevel@tonic-gate switch (iocp->ioc_cmd) {
15097c478bd9Sstevel@tonic-gate case ND_SET:
15107c478bd9Sstevel@tonic-gate case ND_GET:
1511f4b3ec61Sdh if (nd_getset(q, ahstack->ipsecah_g_nd, mp)) {
15127c478bd9Sstevel@tonic-gate qreply(q, mp);
1513d81c80caSToomas Soome return (0);
15147c478bd9Sstevel@tonic-gate } else {
15157c478bd9Sstevel@tonic-gate iocp->ioc_error = ENOENT;
15167c478bd9Sstevel@tonic-gate }
15177c478bd9Sstevel@tonic-gate /* FALLTHRU */
15187c478bd9Sstevel@tonic-gate default:
15197c478bd9Sstevel@tonic-gate /* We really don't support any other ioctls, do we? */
15207c478bd9Sstevel@tonic-gate
15217c478bd9Sstevel@tonic-gate /* Return EINVAL */
15227c478bd9Sstevel@tonic-gate if (iocp->ioc_error != ENOENT)
15237c478bd9Sstevel@tonic-gate iocp->ioc_error = EINVAL;
15247c478bd9Sstevel@tonic-gate iocp->ioc_count = 0;
15257c478bd9Sstevel@tonic-gate mp->b_datap->db_type = M_IOCACK;
15267c478bd9Sstevel@tonic-gate qreply(q, mp);
1527d81c80caSToomas Soome return (0);
15287c478bd9Sstevel@tonic-gate }
15297c478bd9Sstevel@tonic-gate default:
1530f4b3ec61Sdh ah3dbg(ahstack,
1531f4b3ec61Sdh ("Got default message, type %d, passing to IP.\n",
15327c478bd9Sstevel@tonic-gate mp->b_datap->db_type));
15337c478bd9Sstevel@tonic-gate putnext(q, mp);
15347c478bd9Sstevel@tonic-gate }
1535d81c80caSToomas Soome return (0);
15367c478bd9Sstevel@tonic-gate }
15377c478bd9Sstevel@tonic-gate
15385d3b8cb7SBill Sommerfeld /* Refactor me */
15397c478bd9Sstevel@tonic-gate /*
15407c478bd9Sstevel@tonic-gate * Updating use times can be tricky business if the ipsa_haspeer flag is
15417c478bd9Sstevel@tonic-gate * set. This function is called once in an SA's lifetime.
15427c478bd9Sstevel@tonic-gate *
15437c478bd9Sstevel@tonic-gate * Caller has to REFRELE "assoc" which is passed in. This function has
15447c478bd9Sstevel@tonic-gate * to REFRELE any peer SA that is obtained.
15457c478bd9Sstevel@tonic-gate */
15467c478bd9Sstevel@tonic-gate static void
ah_set_usetime(ipsa_t * assoc,boolean_t inbound)15477c478bd9Sstevel@tonic-gate ah_set_usetime(ipsa_t *assoc, boolean_t inbound)
15487c478bd9Sstevel@tonic-gate {
15497c478bd9Sstevel@tonic-gate ipsa_t *inassoc, *outassoc;
15507c478bd9Sstevel@tonic-gate isaf_t *bucket;
15517c478bd9Sstevel@tonic-gate sadb_t *sp;
15527c478bd9Sstevel@tonic-gate int outhash;
15537c478bd9Sstevel@tonic-gate boolean_t isv6;
1554f4b3ec61Sdh netstack_t *ns = assoc->ipsa_netstack;
1555f4b3ec61Sdh ipsecah_stack_t *ahstack = ns->netstack_ipsecah;
15567c478bd9Sstevel@tonic-gate
15577c478bd9Sstevel@tonic-gate /* No peer? No problem! */
15587c478bd9Sstevel@tonic-gate if (!assoc->ipsa_haspeer) {
15597c478bd9Sstevel@tonic-gate sadb_set_usetime(assoc);
15607c478bd9Sstevel@tonic-gate return;
15617c478bd9Sstevel@tonic-gate }
15627c478bd9Sstevel@tonic-gate
15637c478bd9Sstevel@tonic-gate /*
15647c478bd9Sstevel@tonic-gate * Otherwise, we want to grab both the original assoc and its peer.
15657c478bd9Sstevel@tonic-gate * There might be a race for this, but if it's a real race, the times
15667c478bd9Sstevel@tonic-gate * will be out-of-synch by at most a second, and since our time
15677c478bd9Sstevel@tonic-gate * granularity is a second, this won't be a problem.
15687c478bd9Sstevel@tonic-gate *
15697c478bd9Sstevel@tonic-gate * If we need tight synchronization on the peer SA, then we need to
15707c478bd9Sstevel@tonic-gate * reconsider.
15717c478bd9Sstevel@tonic-gate */
15727c478bd9Sstevel@tonic-gate
15737c478bd9Sstevel@tonic-gate /* Use address family to select IPv6/IPv4 */
15747c478bd9Sstevel@tonic-gate isv6 = (assoc->ipsa_addrfam == AF_INET6);
15757c478bd9Sstevel@tonic-gate if (isv6) {
1576f4b3ec61Sdh sp = &ahstack->ah_sadb.s_v6;
15777c478bd9Sstevel@tonic-gate } else {
1578f4b3ec61Sdh sp = &ahstack->ah_sadb.s_v4;
15797c478bd9Sstevel@tonic-gate ASSERT(assoc->ipsa_addrfam == AF_INET);
15807c478bd9Sstevel@tonic-gate }
15817c478bd9Sstevel@tonic-gate if (inbound) {
15827c478bd9Sstevel@tonic-gate inassoc = assoc;
15837c478bd9Sstevel@tonic-gate if (isv6)
1584437220cdSdanmcd outhash = OUTBOUND_HASH_V6(sp,
1585437220cdSdanmcd *((in6_addr_t *)&inassoc->ipsa_dstaddr));
15867c478bd9Sstevel@tonic-gate else
1587437220cdSdanmcd outhash = OUTBOUND_HASH_V4(sp,
1588437220cdSdanmcd *((ipaddr_t *)&inassoc->ipsa_dstaddr));
15897c478bd9Sstevel@tonic-gate bucket = &sp->sdb_of[outhash];
15907c478bd9Sstevel@tonic-gate
15917c478bd9Sstevel@tonic-gate mutex_enter(&bucket->isaf_lock);
15927c478bd9Sstevel@tonic-gate outassoc = ipsec_getassocbyspi(bucket, inassoc->ipsa_spi,
15937c478bd9Sstevel@tonic-gate inassoc->ipsa_srcaddr, inassoc->ipsa_dstaddr,
15947c478bd9Sstevel@tonic-gate inassoc->ipsa_addrfam);
15957c478bd9Sstevel@tonic-gate mutex_exit(&bucket->isaf_lock);
15967c478bd9Sstevel@tonic-gate if (outassoc == NULL) {
15977c478bd9Sstevel@tonic-gate /* Q: Do we wish to set haspeer == B_FALSE? */
15987c478bd9Sstevel@tonic-gate ah0dbg(("ah_set_usetime: "
15997c478bd9Sstevel@tonic-gate "can't find peer for inbound.\n"));
16007c478bd9Sstevel@tonic-gate sadb_set_usetime(inassoc);
16017c478bd9Sstevel@tonic-gate return;
16027c478bd9Sstevel@tonic-gate }
16037c478bd9Sstevel@tonic-gate } else {
16047c478bd9Sstevel@tonic-gate outassoc = assoc;
1605fb87b5d2Ssommerfe bucket = INBOUND_BUCKET(sp, outassoc->ipsa_spi);
16067c478bd9Sstevel@tonic-gate mutex_enter(&bucket->isaf_lock);
16077c478bd9Sstevel@tonic-gate inassoc = ipsec_getassocbyspi(bucket, outassoc->ipsa_spi,
16087c478bd9Sstevel@tonic-gate outassoc->ipsa_srcaddr, outassoc->ipsa_dstaddr,
16097c478bd9Sstevel@tonic-gate outassoc->ipsa_addrfam);
16107c478bd9Sstevel@tonic-gate mutex_exit(&bucket->isaf_lock);
16117c478bd9Sstevel@tonic-gate if (inassoc == NULL) {
16127c478bd9Sstevel@tonic-gate /* Q: Do we wish to set haspeer == B_FALSE? */
16137c478bd9Sstevel@tonic-gate ah0dbg(("ah_set_usetime: "
16147c478bd9Sstevel@tonic-gate "can't find peer for outbound.\n"));
16157c478bd9Sstevel@tonic-gate sadb_set_usetime(outassoc);
16167c478bd9Sstevel@tonic-gate return;
16177c478bd9Sstevel@tonic-gate }
16187c478bd9Sstevel@tonic-gate }
16197c478bd9Sstevel@tonic-gate
16207c478bd9Sstevel@tonic-gate /* Update usetime on both. */
16217c478bd9Sstevel@tonic-gate sadb_set_usetime(inassoc);
16227c478bd9Sstevel@tonic-gate sadb_set_usetime(outassoc);
16237c478bd9Sstevel@tonic-gate
16247c478bd9Sstevel@tonic-gate /*
16257c478bd9Sstevel@tonic-gate * REFRELE any peer SA.
16267c478bd9Sstevel@tonic-gate *
16277c478bd9Sstevel@tonic-gate * Because of the multi-line macro nature of IPSA_REFRELE, keep
16287c478bd9Sstevel@tonic-gate * them in { }.
16297c478bd9Sstevel@tonic-gate */
16307c478bd9Sstevel@tonic-gate if (inbound) {
16317c478bd9Sstevel@tonic-gate IPSA_REFRELE(outassoc);
16327c478bd9Sstevel@tonic-gate } else {
16337c478bd9Sstevel@tonic-gate IPSA_REFRELE(inassoc);
16347c478bd9Sstevel@tonic-gate }
16357c478bd9Sstevel@tonic-gate }
16367c478bd9Sstevel@tonic-gate
16375d3b8cb7SBill Sommerfeld /* Refactor me */
16387c478bd9Sstevel@tonic-gate /*
16397c478bd9Sstevel@tonic-gate * Add a number of bytes to what the SA has protected so far. Return
16407c478bd9Sstevel@tonic-gate * B_TRUE if the SA can still protect that many bytes.
16417c478bd9Sstevel@tonic-gate *
16427c478bd9Sstevel@tonic-gate * Caller must REFRELE the passed-in assoc. This function must REFRELE
16437c478bd9Sstevel@tonic-gate * any obtained peer SA.
16447c478bd9Sstevel@tonic-gate */
16457c478bd9Sstevel@tonic-gate static boolean_t
ah_age_bytes(ipsa_t * assoc,uint64_t bytes,boolean_t inbound)16467c478bd9Sstevel@tonic-gate ah_age_bytes(ipsa_t *assoc, uint64_t bytes, boolean_t inbound)
16477c478bd9Sstevel@tonic-gate {
16487c478bd9Sstevel@tonic-gate ipsa_t *inassoc, *outassoc;
16497c478bd9Sstevel@tonic-gate isaf_t *bucket;
16507c478bd9Sstevel@tonic-gate boolean_t inrc, outrc, isv6;
16517c478bd9Sstevel@tonic-gate sadb_t *sp;
16527c478bd9Sstevel@tonic-gate int outhash;
1653f4b3ec61Sdh netstack_t *ns = assoc->ipsa_netstack;
1654f4b3ec61Sdh ipsecah_stack_t *ahstack = ns->netstack_ipsecah;
16557c478bd9Sstevel@tonic-gate
16567c478bd9Sstevel@tonic-gate /* No peer? No problem! */
16577c478bd9Sstevel@tonic-gate if (!assoc->ipsa_haspeer) {
1658f4b3ec61Sdh return (sadb_age_bytes(ahstack->ah_pfkey_q, assoc, bytes,
16597c478bd9Sstevel@tonic-gate B_TRUE));
16607c478bd9Sstevel@tonic-gate }
16617c478bd9Sstevel@tonic-gate
16627c478bd9Sstevel@tonic-gate /*
16637c478bd9Sstevel@tonic-gate * Otherwise, we want to grab both the original assoc and its peer.
16647c478bd9Sstevel@tonic-gate * There might be a race for this, but if it's a real race, two
16657c478bd9Sstevel@tonic-gate * expire messages may occur. We limit this by only sending the
16667c478bd9Sstevel@tonic-gate * expire message on one of the peers, we'll pick the inbound
16677c478bd9Sstevel@tonic-gate * arbitrarily.
16687c478bd9Sstevel@tonic-gate *
16697c478bd9Sstevel@tonic-gate * If we need tight synchronization on the peer SA, then we need to
16707c478bd9Sstevel@tonic-gate * reconsider.
16717c478bd9Sstevel@tonic-gate */
16727c478bd9Sstevel@tonic-gate
16737c478bd9Sstevel@tonic-gate /* Pick v4/v6 bucket based on addrfam. */
16747c478bd9Sstevel@tonic-gate isv6 = (assoc->ipsa_addrfam == AF_INET6);
16757c478bd9Sstevel@tonic-gate if (isv6) {
1676f4b3ec61Sdh sp = &ahstack->ah_sadb.s_v6;
16777c478bd9Sstevel@tonic-gate } else {
1678f4b3ec61Sdh sp = &ahstack->ah_sadb.s_v4;
16797c478bd9Sstevel@tonic-gate ASSERT(assoc->ipsa_addrfam == AF_INET);
16807c478bd9Sstevel@tonic-gate }
16817c478bd9Sstevel@tonic-gate if (inbound) {
16827c478bd9Sstevel@tonic-gate inassoc = assoc;
16837c478bd9Sstevel@tonic-gate if (isv6)
1684437220cdSdanmcd outhash = OUTBOUND_HASH_V6(sp,
1685437220cdSdanmcd *((in6_addr_t *)&inassoc->ipsa_dstaddr));
16867c478bd9Sstevel@tonic-gate else
1687437220cdSdanmcd outhash = OUTBOUND_HASH_V4(sp,
1688437220cdSdanmcd *((ipaddr_t *)&inassoc->ipsa_dstaddr));
16897c478bd9Sstevel@tonic-gate bucket = &sp->sdb_of[outhash];
16907c478bd9Sstevel@tonic-gate mutex_enter(&bucket->isaf_lock);
16917c478bd9Sstevel@tonic-gate outassoc = ipsec_getassocbyspi(bucket, inassoc->ipsa_spi,
16927c478bd9Sstevel@tonic-gate inassoc->ipsa_srcaddr, inassoc->ipsa_dstaddr,
16937c478bd9Sstevel@tonic-gate inassoc->ipsa_addrfam);
16947c478bd9Sstevel@tonic-gate mutex_exit(&bucket->isaf_lock);
16957c478bd9Sstevel@tonic-gate if (outassoc == NULL) {
16967c478bd9Sstevel@tonic-gate /* Q: Do we wish to set haspeer == B_FALSE? */
16977c478bd9Sstevel@tonic-gate ah0dbg(("ah_age_bytes: "
16987c478bd9Sstevel@tonic-gate "can't find peer for inbound.\n"));
1699f4b3ec61Sdh return (sadb_age_bytes(ahstack->ah_pfkey_q, inassoc,
17007c478bd9Sstevel@tonic-gate bytes, B_TRUE));
17017c478bd9Sstevel@tonic-gate }
17027c478bd9Sstevel@tonic-gate } else {
17037c478bd9Sstevel@tonic-gate outassoc = assoc;
1704fb87b5d2Ssommerfe bucket = INBOUND_BUCKET(sp, outassoc->ipsa_spi);
17057c478bd9Sstevel@tonic-gate mutex_enter(&bucket->isaf_lock);
17067c478bd9Sstevel@tonic-gate inassoc = ipsec_getassocbyspi(bucket, outassoc->ipsa_spi,
17077c478bd9Sstevel@tonic-gate outassoc->ipsa_srcaddr, outassoc->ipsa_dstaddr,
17087c478bd9Sstevel@tonic-gate outassoc->ipsa_addrfam);
17097c478bd9Sstevel@tonic-gate mutex_exit(&bucket->isaf_lock);
17107c478bd9Sstevel@tonic-gate if (inassoc == NULL) {
17117c478bd9Sstevel@tonic-gate /* Q: Do we wish to set haspeer == B_FALSE? */
17127c478bd9Sstevel@tonic-gate ah0dbg(("ah_age_bytes: "
17137c478bd9Sstevel@tonic-gate "can't find peer for outbound.\n"));
1714f4b3ec61Sdh return (sadb_age_bytes(ahstack->ah_pfkey_q, outassoc,
17157c478bd9Sstevel@tonic-gate bytes, B_TRUE));
17167c478bd9Sstevel@tonic-gate }
17177c478bd9Sstevel@tonic-gate }
17187c478bd9Sstevel@tonic-gate
1719f4b3ec61Sdh inrc = sadb_age_bytes(ahstack->ah_pfkey_q, inassoc, bytes, B_TRUE);
1720f4b3ec61Sdh outrc = sadb_age_bytes(ahstack->ah_pfkey_q, outassoc, bytes, B_FALSE);
17217c478bd9Sstevel@tonic-gate
17227c478bd9Sstevel@tonic-gate /*
17237c478bd9Sstevel@tonic-gate * REFRELE any peer SA.
17247c478bd9Sstevel@tonic-gate *
17257c478bd9Sstevel@tonic-gate * Because of the multi-line macro nature of IPSA_REFRELE, keep
17267c478bd9Sstevel@tonic-gate * them in { }.
17277c478bd9Sstevel@tonic-gate */
17287c478bd9Sstevel@tonic-gate if (inbound) {
17297c478bd9Sstevel@tonic-gate IPSA_REFRELE(outassoc);
17307c478bd9Sstevel@tonic-gate } else {
17317c478bd9Sstevel@tonic-gate IPSA_REFRELE(inassoc);
17327c478bd9Sstevel@tonic-gate }
17337c478bd9Sstevel@tonic-gate
17347c478bd9Sstevel@tonic-gate return (inrc && outrc);
17357c478bd9Sstevel@tonic-gate }
17367c478bd9Sstevel@tonic-gate
17375d3b8cb7SBill Sommerfeld /* Refactor me */
17387c478bd9Sstevel@tonic-gate /*
17397c478bd9Sstevel@tonic-gate * Handle the SADB_GETSPI message. Create a larval SA.
17407c478bd9Sstevel@tonic-gate */
17417c478bd9Sstevel@tonic-gate static void
ah_getspi(mblk_t * mp,keysock_in_t * ksi,ipsecah_stack_t * ahstack)1742f4b3ec61Sdh ah_getspi(mblk_t *mp, keysock_in_t *ksi, ipsecah_stack_t *ahstack)
17437c478bd9Sstevel@tonic-gate {
17447c478bd9Sstevel@tonic-gate ipsa_t *newbie, *target;
17457c478bd9Sstevel@tonic-gate isaf_t *outbound, *inbound;
17467c478bd9Sstevel@tonic-gate int rc, diagnostic;
17477c478bd9Sstevel@tonic-gate sadb_sa_t *assoc;
17487c478bd9Sstevel@tonic-gate keysock_out_t *kso;
17497c478bd9Sstevel@tonic-gate uint32_t newspi;
17507c478bd9Sstevel@tonic-gate
17517c478bd9Sstevel@tonic-gate /*
17527c478bd9Sstevel@tonic-gate * Randomly generate a proposed SPI value.
17537c478bd9Sstevel@tonic-gate */
17549c2c14abSThejaswini Singarajipura if (cl_inet_getspi != NULL) {
17558e4b770fSLu Huafeng cl_inet_getspi(ahstack->ipsecah_netstack->netstack_stackid,
17568e4b770fSLu Huafeng IPPROTO_AH, (uint8_t *)&newspi, sizeof (uint32_t), NULL);
17579c2c14abSThejaswini Singarajipura } else {
17589c2c14abSThejaswini Singarajipura (void) random_get_pseudo_bytes((uint8_t *)&newspi,
17599c2c14abSThejaswini Singarajipura sizeof (uint32_t));
17609c2c14abSThejaswini Singarajipura }
1761f4b3ec61Sdh newbie = sadb_getspi(ksi, newspi, &diagnostic,
17629c2c14abSThejaswini Singarajipura ahstack->ipsecah_netstack, IPPROTO_AH);
17637c478bd9Sstevel@tonic-gate
17647c478bd9Sstevel@tonic-gate if (newbie == NULL) {
1765f4b3ec61Sdh sadb_pfkey_error(ahstack->ah_pfkey_q, mp, ENOMEM, diagnostic,
17667c478bd9Sstevel@tonic-gate ksi->ks_in_serial);
17677c478bd9Sstevel@tonic-gate return;
17687c478bd9Sstevel@tonic-gate } else if (newbie == (ipsa_t *)-1) {
1769f4b3ec61Sdh sadb_pfkey_error(ahstack->ah_pfkey_q, mp, EINVAL, diagnostic,
17707c478bd9Sstevel@tonic-gate ksi->ks_in_serial);
17717c478bd9Sstevel@tonic-gate return;
17727c478bd9Sstevel@tonic-gate }
17737c478bd9Sstevel@tonic-gate
17747c478bd9Sstevel@tonic-gate /*
17757c478bd9Sstevel@tonic-gate * XXX - We may randomly collide. We really should recover from this.
17767c478bd9Sstevel@tonic-gate * Unfortunately, that could require spending way-too-much-time
17777c478bd9Sstevel@tonic-gate * in here. For now, let the user retry.
17787c478bd9Sstevel@tonic-gate */
17797c478bd9Sstevel@tonic-gate
17807c478bd9Sstevel@tonic-gate if (newbie->ipsa_addrfam == AF_INET6) {
1781f4b3ec61Sdh outbound = OUTBOUND_BUCKET_V6(&ahstack->ah_sadb.s_v6,
1782fb87b5d2Ssommerfe *(uint32_t *)(newbie->ipsa_dstaddr));
1783f4b3ec61Sdh inbound = INBOUND_BUCKET(&ahstack->ah_sadb.s_v6,
1784f4b3ec61Sdh newbie->ipsa_spi);
17857c478bd9Sstevel@tonic-gate } else {
1786f4b3ec61Sdh outbound = OUTBOUND_BUCKET_V4(&ahstack->ah_sadb.s_v4,
1787fb87b5d2Ssommerfe *(uint32_t *)(newbie->ipsa_dstaddr));
1788f4b3ec61Sdh inbound = INBOUND_BUCKET(&ahstack->ah_sadb.s_v4,
1789f4b3ec61Sdh newbie->ipsa_spi);
17907c478bd9Sstevel@tonic-gate }
17917c478bd9Sstevel@tonic-gate
17927c478bd9Sstevel@tonic-gate mutex_enter(&outbound->isaf_lock);
17937c478bd9Sstevel@tonic-gate mutex_enter(&inbound->isaf_lock);
17947c478bd9Sstevel@tonic-gate
17957c478bd9Sstevel@tonic-gate /*
17967c478bd9Sstevel@tonic-gate * Check for collisions (i.e. did sadb_getspi() return with something
17977c478bd9Sstevel@tonic-gate * that already exists?).
17987c478bd9Sstevel@tonic-gate *
17997c478bd9Sstevel@tonic-gate * Try outbound first. Even though SADB_GETSPI is traditionally
18007c478bd9Sstevel@tonic-gate * for inbound SAs, you never know what a user might do.
18017c478bd9Sstevel@tonic-gate */
18027c478bd9Sstevel@tonic-gate target = ipsec_getassocbyspi(outbound, newbie->ipsa_spi,
18037c478bd9Sstevel@tonic-gate newbie->ipsa_srcaddr, newbie->ipsa_dstaddr, newbie->ipsa_addrfam);
18047c478bd9Sstevel@tonic-gate if (target == NULL) {
18057c478bd9Sstevel@tonic-gate target = ipsec_getassocbyspi(inbound, newbie->ipsa_spi,
18067c478bd9Sstevel@tonic-gate newbie->ipsa_srcaddr, newbie->ipsa_dstaddr,
18077c478bd9Sstevel@tonic-gate newbie->ipsa_addrfam);
18087c478bd9Sstevel@tonic-gate }
18097c478bd9Sstevel@tonic-gate
18107c478bd9Sstevel@tonic-gate /*
18117c478bd9Sstevel@tonic-gate * I don't have collisions elsewhere!
18127c478bd9Sstevel@tonic-gate * (Nor will I because I'm still holding inbound/outbound locks.)
18137c478bd9Sstevel@tonic-gate */
18147c478bd9Sstevel@tonic-gate
18157c478bd9Sstevel@tonic-gate if (target != NULL) {
18167c478bd9Sstevel@tonic-gate rc = EEXIST;
18177c478bd9Sstevel@tonic-gate IPSA_REFRELE(target);
18187c478bd9Sstevel@tonic-gate } else {
18197c478bd9Sstevel@tonic-gate /*
18207c478bd9Sstevel@tonic-gate * sadb_insertassoc() also checks for collisions, so
18217c478bd9Sstevel@tonic-gate * if there's a colliding larval entry, rc will be set
18227c478bd9Sstevel@tonic-gate * to EEXIST.
18237c478bd9Sstevel@tonic-gate */
18247c478bd9Sstevel@tonic-gate rc = sadb_insertassoc(newbie, inbound);
1825437220cdSdanmcd newbie->ipsa_hardexpiretime = gethrestime_sec();
1826f4b3ec61Sdh newbie->ipsa_hardexpiretime += ahstack->ipsecah_larval_timeout;
18277c478bd9Sstevel@tonic-gate }
18287c478bd9Sstevel@tonic-gate
18297c478bd9Sstevel@tonic-gate /*
18307c478bd9Sstevel@tonic-gate * Can exit outbound mutex. Hold inbound until we're done with
18317c478bd9Sstevel@tonic-gate * newbie.
18327c478bd9Sstevel@tonic-gate */
18337c478bd9Sstevel@tonic-gate mutex_exit(&outbound->isaf_lock);
18347c478bd9Sstevel@tonic-gate
18357c478bd9Sstevel@tonic-gate if (rc != 0) {
18367c478bd9Sstevel@tonic-gate mutex_exit(&inbound->isaf_lock);
18377c478bd9Sstevel@tonic-gate IPSA_REFRELE(newbie);
1838f4b3ec61Sdh sadb_pfkey_error(ahstack->ah_pfkey_q, mp, rc,
1839f4b3ec61Sdh SADB_X_DIAGNOSTIC_NONE, ksi->ks_in_serial);
18407c478bd9Sstevel@tonic-gate return;
18417c478bd9Sstevel@tonic-gate }
18427c478bd9Sstevel@tonic-gate
18437c478bd9Sstevel@tonic-gate /* Can write here because I'm still holding the bucket lock. */
18447c478bd9Sstevel@tonic-gate newbie->ipsa_type = SADB_SATYPE_AH;
18457c478bd9Sstevel@tonic-gate
18467c478bd9Sstevel@tonic-gate /*
18477c478bd9Sstevel@tonic-gate * Construct successful return message. We have one thing going
18487c478bd9Sstevel@tonic-gate * for us in PF_KEY v2. That's the fact that
18497c478bd9Sstevel@tonic-gate * sizeof (sadb_spirange_t) == sizeof (sadb_sa_t)
18507c478bd9Sstevel@tonic-gate */
18517c478bd9Sstevel@tonic-gate assoc = (sadb_sa_t *)ksi->ks_in_extv[SADB_EXT_SPIRANGE];
18527c478bd9Sstevel@tonic-gate assoc->sadb_sa_exttype = SADB_EXT_SA;
18537c478bd9Sstevel@tonic-gate assoc->sadb_sa_spi = newbie->ipsa_spi;
18547c478bd9Sstevel@tonic-gate *((uint64_t *)(&assoc->sadb_sa_replay)) = 0;
18557c478bd9Sstevel@tonic-gate mutex_exit(&inbound->isaf_lock);
18567c478bd9Sstevel@tonic-gate
18577c478bd9Sstevel@tonic-gate /* Convert KEYSOCK_IN to KEYSOCK_OUT. */
18587c478bd9Sstevel@tonic-gate kso = (keysock_out_t *)ksi;
18597c478bd9Sstevel@tonic-gate kso->ks_out_len = sizeof (*kso);
18607c478bd9Sstevel@tonic-gate kso->ks_out_serial = ksi->ks_in_serial;
18617c478bd9Sstevel@tonic-gate kso->ks_out_type = KEYSOCK_OUT;
18627c478bd9Sstevel@tonic-gate
18637c478bd9Sstevel@tonic-gate /*
18647c478bd9Sstevel@tonic-gate * Can safely putnext() to ah_pfkey_q, because this is a turnaround
18657c478bd9Sstevel@tonic-gate * from the ah_pfkey_q.
18667c478bd9Sstevel@tonic-gate */
1867f4b3ec61Sdh putnext(ahstack->ah_pfkey_q, mp);
18687c478bd9Sstevel@tonic-gate }
18697c478bd9Sstevel@tonic-gate
18707c478bd9Sstevel@tonic-gate /*
18717c478bd9Sstevel@tonic-gate * IPv6 sends up the ICMP errors for validation and the removal of the AH
18727c478bd9Sstevel@tonic-gate * header.
1873bd670b35SErik Nordmark * If succesful, the mp has been modified to not include the AH header so
1874bd670b35SErik Nordmark * that the caller can fanout to the ULP's icmp error handler.
18757c478bd9Sstevel@tonic-gate */
1876bd670b35SErik Nordmark static mblk_t *
ah_icmp_error_v6(mblk_t * mp,ip_recv_attr_t * ira,ipsecah_stack_t * ahstack)1877bd670b35SErik Nordmark ah_icmp_error_v6(mblk_t *mp, ip_recv_attr_t *ira, ipsecah_stack_t *ahstack)
18787c478bd9Sstevel@tonic-gate {
18797c478bd9Sstevel@tonic-gate ip6_t *ip6h, *oip6h;
18807c478bd9Sstevel@tonic-gate uint16_t hdr_length, ah_length;
18817c478bd9Sstevel@tonic-gate uint8_t *nexthdrp;
18827c478bd9Sstevel@tonic-gate ah_t *ah;
18837c478bd9Sstevel@tonic-gate icmp6_t *icmp6;
18847c478bd9Sstevel@tonic-gate isaf_t *isaf;
18857c478bd9Sstevel@tonic-gate ipsa_t *assoc;
18867c478bd9Sstevel@tonic-gate uint8_t *post_ah_ptr;
1887f4b3ec61Sdh ipsec_stack_t *ipss = ahstack->ipsecah_netstack->netstack_ipsec;
18887c478bd9Sstevel@tonic-gate
18897c478bd9Sstevel@tonic-gate /*
18907c478bd9Sstevel@tonic-gate * Eat the cost of a pullupmsg() for now. It makes the rest of this
18917c478bd9Sstevel@tonic-gate * code far less convoluted.
18927c478bd9Sstevel@tonic-gate */
18937c478bd9Sstevel@tonic-gate if (!pullupmsg(mp, -1) ||
18947c478bd9Sstevel@tonic-gate !ip_hdr_length_nexthdr_v6(mp, (ip6_t *)mp->b_rptr, &hdr_length,
1895437220cdSdanmcd &nexthdrp) ||
18967c478bd9Sstevel@tonic-gate mp->b_rptr + hdr_length + sizeof (icmp6_t) + sizeof (ip6_t) +
18977c478bd9Sstevel@tonic-gate sizeof (ah_t) > mp->b_wptr) {
1898f4b3ec61Sdh IP_AH_BUMP_STAT(ipss, in_discards);
1899bd670b35SErik Nordmark ip_drop_packet(mp, B_TRUE, ira->ira_ill,
1900f4b3ec61Sdh DROPPER(ipss, ipds_ah_nomem),
1901f4b3ec61Sdh &ahstack->ah_dropper);
1902bd670b35SErik Nordmark return (NULL);
19037c478bd9Sstevel@tonic-gate }
19047c478bd9Sstevel@tonic-gate
19057c478bd9Sstevel@tonic-gate oip6h = (ip6_t *)mp->b_rptr;
19067c478bd9Sstevel@tonic-gate icmp6 = (icmp6_t *)((uint8_t *)oip6h + hdr_length);
19077c478bd9Sstevel@tonic-gate ip6h = (ip6_t *)(icmp6 + 1);
19087c478bd9Sstevel@tonic-gate if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &hdr_length, &nexthdrp)) {
1909f4b3ec61Sdh IP_AH_BUMP_STAT(ipss, in_discards);
1910bd670b35SErik Nordmark ip_drop_packet(mp, B_TRUE, ira->ira_ill,
1911f4b3ec61Sdh DROPPER(ipss, ipds_ah_bad_v6_hdrs),
1912f4b3ec61Sdh &ahstack->ah_dropper);
1913bd670b35SErik Nordmark return (NULL);
19147c478bd9Sstevel@tonic-gate }
19157c478bd9Sstevel@tonic-gate ah = (ah_t *)((uint8_t *)ip6h + hdr_length);
19167c478bd9Sstevel@tonic-gate
1917f4b3ec61Sdh isaf = OUTBOUND_BUCKET_V6(&ahstack->ah_sadb.s_v6, ip6h->ip6_dst);
19187c478bd9Sstevel@tonic-gate mutex_enter(&isaf->isaf_lock);
19197c478bd9Sstevel@tonic-gate assoc = ipsec_getassocbyspi(isaf, ah->ah_spi,
19207c478bd9Sstevel@tonic-gate (uint32_t *)&ip6h->ip6_src, (uint32_t *)&ip6h->ip6_dst, AF_INET6);
19217c478bd9Sstevel@tonic-gate mutex_exit(&isaf->isaf_lock);
19227c478bd9Sstevel@tonic-gate
19237c478bd9Sstevel@tonic-gate if (assoc == NULL) {
1924f4b3ec61Sdh IP_AH_BUMP_STAT(ipss, lookup_failure);
1925f4b3ec61Sdh IP_AH_BUMP_STAT(ipss, in_discards);
1926f4b3ec61Sdh if (ahstack->ipsecah_log_unknown_spi) {
19277c478bd9Sstevel@tonic-gate ipsec_assocfailure(info.mi_idnum, 0, 0,
19287c478bd9Sstevel@tonic-gate SL_CONSOLE | SL_WARN | SL_ERROR,
19297c478bd9Sstevel@tonic-gate "Bad ICMP message - No association for the "
19307c478bd9Sstevel@tonic-gate "attached AH header whose spi is 0x%x, "
19317c478bd9Sstevel@tonic-gate "sender is 0x%x\n",
1932f4b3ec61Sdh ah->ah_spi, &oip6h->ip6_src, AF_INET6,
1933f4b3ec61Sdh ahstack->ipsecah_netstack);
19347c478bd9Sstevel@tonic-gate }
1935bd670b35SErik Nordmark ip_drop_packet(mp, B_TRUE, ira->ira_ill,
1936f4b3ec61Sdh DROPPER(ipss, ipds_ah_no_sa),
1937f4b3ec61Sdh &ahstack->ah_dropper);
1938bd670b35SErik Nordmark return (NULL);
19397c478bd9Sstevel@tonic-gate }
19407c478bd9Sstevel@tonic-gate
19417c478bd9Sstevel@tonic-gate IPSA_REFRELE(assoc);
19427c478bd9Sstevel@tonic-gate
19437c478bd9Sstevel@tonic-gate /*
19447c478bd9Sstevel@tonic-gate * There seems to be a valid association. If there is enough of AH
19457c478bd9Sstevel@tonic-gate * header remove it, otherwise bail. One could check whether it has
19467c478bd9Sstevel@tonic-gate * complete AH header plus 8 bytes but it does not make sense if an
19477c478bd9Sstevel@tonic-gate * icmp error is returned for ICMP messages e.g ICMP time exceeded,
19487c478bd9Sstevel@tonic-gate * that are being sent up. Let the caller figure out.
19497c478bd9Sstevel@tonic-gate *
19507c478bd9Sstevel@tonic-gate * NOTE: ah_length is the number of 32 bit words minus 2.
19517c478bd9Sstevel@tonic-gate */
19527c478bd9Sstevel@tonic-gate ah_length = (ah->ah_length << 2) + 8;
19537c478bd9Sstevel@tonic-gate post_ah_ptr = (uint8_t *)ah + ah_length;
19547c478bd9Sstevel@tonic-gate
19557c478bd9Sstevel@tonic-gate if (post_ah_ptr > mp->b_wptr) {
1956f4b3ec61Sdh IP_AH_BUMP_STAT(ipss, in_discards);
1957bd670b35SErik Nordmark ip_drop_packet(mp, B_TRUE, ira->ira_ill,
1958f4b3ec61Sdh DROPPER(ipss, ipds_ah_bad_length),
1959f4b3ec61Sdh &ahstack->ah_dropper);
1960bd670b35SErik Nordmark return (NULL);
19617c478bd9Sstevel@tonic-gate }
19627c478bd9Sstevel@tonic-gate
19637c478bd9Sstevel@tonic-gate ip6h->ip6_plen = htons(ntohs(ip6h->ip6_plen) - ah_length);
19647c478bd9Sstevel@tonic-gate *nexthdrp = ah->ah_nexthdr;
19657c478bd9Sstevel@tonic-gate ovbcopy(post_ah_ptr, ah,
19667c478bd9Sstevel@tonic-gate (size_t)((uintptr_t)mp->b_wptr - (uintptr_t)post_ah_ptr));
19677c478bd9Sstevel@tonic-gate mp->b_wptr -= ah_length;
19687c478bd9Sstevel@tonic-gate
1969bd670b35SErik Nordmark return (mp);
19707c478bd9Sstevel@tonic-gate }
19717c478bd9Sstevel@tonic-gate
19727c478bd9Sstevel@tonic-gate /*
19737c478bd9Sstevel@tonic-gate * IP sends up the ICMP errors for validation and the removal of
19747c478bd9Sstevel@tonic-gate * the AH header.
1975bd670b35SErik Nordmark * If succesful, the mp has been modified to not include the AH header so
1976bd670b35SErik Nordmark * that the caller can fanout to the ULP's icmp error handler.
19777c478bd9Sstevel@tonic-gate */
1978bd670b35SErik Nordmark static mblk_t *
ah_icmp_error_v4(mblk_t * mp,ip_recv_attr_t * ira,ipsecah_stack_t * ahstack)1979bd670b35SErik Nordmark ah_icmp_error_v4(mblk_t *mp, ip_recv_attr_t *ira, ipsecah_stack_t *ahstack)
19807c478bd9Sstevel@tonic-gate {
19817c478bd9Sstevel@tonic-gate mblk_t *mp1;
19827c478bd9Sstevel@tonic-gate icmph_t *icmph;
19837c478bd9Sstevel@tonic-gate int iph_hdr_length;
19847c478bd9Sstevel@tonic-gate int hdr_length;
19857c478bd9Sstevel@tonic-gate isaf_t *hptr;
19867c478bd9Sstevel@tonic-gate ipsa_t *assoc;
19877c478bd9Sstevel@tonic-gate int ah_length;
19887c478bd9Sstevel@tonic-gate ipha_t *ipha;
19897c478bd9Sstevel@tonic-gate ipha_t *oipha;
19907c478bd9Sstevel@tonic-gate ah_t *ah;
19917c478bd9Sstevel@tonic-gate uint32_t length;
19927c478bd9Sstevel@tonic-gate int alloc_size;
19937c478bd9Sstevel@tonic-gate uint8_t nexthdr;
1994f4b3ec61Sdh ipsec_stack_t *ipss = ahstack->ipsecah_netstack->netstack_ipsec;
19957c478bd9Sstevel@tonic-gate
19967c478bd9Sstevel@tonic-gate oipha = ipha = (ipha_t *)mp->b_rptr;
19977c478bd9Sstevel@tonic-gate iph_hdr_length = IPH_HDR_LENGTH(ipha);
19987c478bd9Sstevel@tonic-gate icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
19997c478bd9Sstevel@tonic-gate
20007c478bd9Sstevel@tonic-gate ipha = (ipha_t *)&icmph[1];
20017c478bd9Sstevel@tonic-gate hdr_length = IPH_HDR_LENGTH(ipha);
20027c478bd9Sstevel@tonic-gate
20037c478bd9Sstevel@tonic-gate /*
20047c478bd9Sstevel@tonic-gate * See if we have enough to locate the SPI
20057c478bd9Sstevel@tonic-gate */
20067c478bd9Sstevel@tonic-gate if ((uchar_t *)ipha + hdr_length + 8 > mp->b_wptr) {
20077c478bd9Sstevel@tonic-gate if (!pullupmsg(mp, (uchar_t *)ipha + hdr_length + 8 -
2008437220cdSdanmcd mp->b_rptr)) {
2009f4b3ec61Sdh ipsec_rl_strlog(ahstack->ipsecah_netstack,
2010f4b3ec61Sdh info.mi_idnum, 0, 0,
20117c478bd9Sstevel@tonic-gate SL_WARN | SL_ERROR,
20127c478bd9Sstevel@tonic-gate "ICMP error: Small AH header\n");
2013f4b3ec61Sdh IP_AH_BUMP_STAT(ipss, in_discards);
2014bd670b35SErik Nordmark ip_drop_packet(mp, B_TRUE, ira->ira_ill,
2015f4b3ec61Sdh DROPPER(ipss, ipds_ah_bad_length),
2016f4b3ec61Sdh &ahstack->ah_dropper);
2017bd670b35SErik Nordmark return (NULL);
20187c478bd9Sstevel@tonic-gate }
20197c478bd9Sstevel@tonic-gate icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
20207c478bd9Sstevel@tonic-gate ipha = (ipha_t *)&icmph[1];
20217c478bd9Sstevel@tonic-gate }
20227c478bd9Sstevel@tonic-gate
20237c478bd9Sstevel@tonic-gate ah = (ah_t *)((uint8_t *)ipha + hdr_length);
20247c478bd9Sstevel@tonic-gate nexthdr = ah->ah_nexthdr;
20257c478bd9Sstevel@tonic-gate
2026f4b3ec61Sdh hptr = OUTBOUND_BUCKET_V4(&ahstack->ah_sadb.s_v4, ipha->ipha_dst);
20277c478bd9Sstevel@tonic-gate mutex_enter(&hptr->isaf_lock);
20287c478bd9Sstevel@tonic-gate assoc = ipsec_getassocbyspi(hptr, ah->ah_spi,
20297c478bd9Sstevel@tonic-gate (uint32_t *)&ipha->ipha_src, (uint32_t *)&ipha->ipha_dst, AF_INET);
20307c478bd9Sstevel@tonic-gate mutex_exit(&hptr->isaf_lock);
20317c478bd9Sstevel@tonic-gate
20327c478bd9Sstevel@tonic-gate if (assoc == NULL) {
2033f4b3ec61Sdh IP_AH_BUMP_STAT(ipss, lookup_failure);
2034f4b3ec61Sdh IP_AH_BUMP_STAT(ipss, in_discards);
2035f4b3ec61Sdh if (ahstack->ipsecah_log_unknown_spi) {
20367c478bd9Sstevel@tonic-gate ipsec_assocfailure(info.mi_idnum, 0, 0,
20377c478bd9Sstevel@tonic-gate SL_CONSOLE | SL_WARN | SL_ERROR,
20387c478bd9Sstevel@tonic-gate "Bad ICMP message - No association for the "
20397c478bd9Sstevel@tonic-gate "attached AH header whose spi is 0x%x, "
20407c478bd9Sstevel@tonic-gate "sender is 0x%x\n",
2041f4b3ec61Sdh ah->ah_spi, &oipha->ipha_src, AF_INET,
2042f4b3ec61Sdh ahstack->ipsecah_netstack);
20437c478bd9Sstevel@tonic-gate }
2044bd670b35SErik Nordmark ip_drop_packet(mp, B_TRUE, ira->ira_ill,
2045f4b3ec61Sdh DROPPER(ipss, ipds_ah_no_sa),
2046f4b3ec61Sdh &ahstack->ah_dropper);
2047bd670b35SErik Nordmark return (NULL);
20487c478bd9Sstevel@tonic-gate }
20497c478bd9Sstevel@tonic-gate
20507c478bd9Sstevel@tonic-gate IPSA_REFRELE(assoc);
20517c478bd9Sstevel@tonic-gate /*
20527c478bd9Sstevel@tonic-gate * There seems to be a valid association. If there
20537c478bd9Sstevel@tonic-gate * is enough of AH header remove it, otherwise remove
20547c478bd9Sstevel@tonic-gate * as much as possible and send it back. One could check
20557c478bd9Sstevel@tonic-gate * whether it has complete AH header plus 8 bytes but it
20567c478bd9Sstevel@tonic-gate * does not make sense if an icmp error is returned for
20577c478bd9Sstevel@tonic-gate * ICMP messages e.g ICMP time exceeded, that are being
20587c478bd9Sstevel@tonic-gate * sent up. Let the caller figure out.
20597c478bd9Sstevel@tonic-gate *
20607c478bd9Sstevel@tonic-gate * NOTE: ah_length is the number of 32 bit words minus 2.
20617c478bd9Sstevel@tonic-gate */
20627c478bd9Sstevel@tonic-gate ah_length = (ah->ah_length << 2) + 8;
20637c478bd9Sstevel@tonic-gate
20647c478bd9Sstevel@tonic-gate if ((uchar_t *)ipha + hdr_length + ah_length > mp->b_wptr) {
20657c478bd9Sstevel@tonic-gate if (mp->b_cont == NULL) {
20667c478bd9Sstevel@tonic-gate /*
20677c478bd9Sstevel@tonic-gate * There is nothing to pullup. Just remove as
20687c478bd9Sstevel@tonic-gate * much as possible. This is a common case for
20697c478bd9Sstevel@tonic-gate * IPV4.
20707c478bd9Sstevel@tonic-gate */
20717c478bd9Sstevel@tonic-gate ah_length = (mp->b_wptr - ((uchar_t *)ipha +
20727c478bd9Sstevel@tonic-gate hdr_length));
20737c478bd9Sstevel@tonic-gate goto done;
20747c478bd9Sstevel@tonic-gate }
20757c478bd9Sstevel@tonic-gate /* Pullup the full ah header */
20767c478bd9Sstevel@tonic-gate if (!pullupmsg(mp, (uchar_t *)ah + ah_length - mp->b_rptr)) {
20777c478bd9Sstevel@tonic-gate /*
20787c478bd9Sstevel@tonic-gate * pullupmsg could have failed if there was not
20797c478bd9Sstevel@tonic-gate * enough to pullup or memory allocation failed.
20807c478bd9Sstevel@tonic-gate * We tried hard, give up now.
20817c478bd9Sstevel@tonic-gate */
2082f4b3ec61Sdh IP_AH_BUMP_STAT(ipss, in_discards);
2083bd670b35SErik Nordmark ip_drop_packet(mp, B_TRUE, ira->ira_ill,
2084f4b3ec61Sdh DROPPER(ipss, ipds_ah_nomem),
2085f4b3ec61Sdh &ahstack->ah_dropper);
2086bd670b35SErik Nordmark return (NULL);
20877c478bd9Sstevel@tonic-gate }
20887c478bd9Sstevel@tonic-gate icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
20897c478bd9Sstevel@tonic-gate ipha = (ipha_t *)&icmph[1];
20907c478bd9Sstevel@tonic-gate }
20917c478bd9Sstevel@tonic-gate done:
20927c478bd9Sstevel@tonic-gate /*
20937c478bd9Sstevel@tonic-gate * Remove the AH header and change the protocol.
2094bd670b35SErik Nordmark * Don't update the spi fields in the ip_recv_attr_t
2095bd670b35SErik Nordmark * as we are called just to validate the
20967c478bd9Sstevel@tonic-gate * message attached to the ICMP message.
20977c478bd9Sstevel@tonic-gate *
20987c478bd9Sstevel@tonic-gate * If we never pulled up since all of the message
20997c478bd9Sstevel@tonic-gate * is in one single mblk, we can't remove the AH header
21007c478bd9Sstevel@tonic-gate * by just setting the b_wptr to the beginning of the
21017c478bd9Sstevel@tonic-gate * AH header. We need to allocate a mblk that can hold
21027c478bd9Sstevel@tonic-gate * up until the inner IP header and copy them.
21037c478bd9Sstevel@tonic-gate */
21047c478bd9Sstevel@tonic-gate alloc_size = iph_hdr_length + sizeof (icmph_t) + hdr_length;
21057c478bd9Sstevel@tonic-gate
21067c478bd9Sstevel@tonic-gate if ((mp1 = allocb(alloc_size, BPRI_LO)) == NULL) {
2107f4b3ec61Sdh IP_AH_BUMP_STAT(ipss, in_discards);
2108bd670b35SErik Nordmark ip_drop_packet(mp, B_TRUE, ira->ira_ill,
2109f4b3ec61Sdh DROPPER(ipss, ipds_ah_nomem),
2110f4b3ec61Sdh &ahstack->ah_dropper);
2111bd670b35SErik Nordmark return (NULL);
21127c478bd9Sstevel@tonic-gate }
21137c478bd9Sstevel@tonic-gate bcopy(mp->b_rptr, mp1->b_rptr, alloc_size);
21147c478bd9Sstevel@tonic-gate mp1->b_wptr += alloc_size;
21157c478bd9Sstevel@tonic-gate
21167c478bd9Sstevel@tonic-gate /*
21177c478bd9Sstevel@tonic-gate * Skip whatever we have copied and as much of AH header
21187c478bd9Sstevel@tonic-gate * possible. If we still have something left in the original
21197c478bd9Sstevel@tonic-gate * message, tag on.
21207c478bd9Sstevel@tonic-gate */
21217c478bd9Sstevel@tonic-gate mp->b_rptr = (uchar_t *)ipha + hdr_length + ah_length;
21227c478bd9Sstevel@tonic-gate
21237c478bd9Sstevel@tonic-gate if (mp->b_rptr != mp->b_wptr) {
21247c478bd9Sstevel@tonic-gate mp1->b_cont = mp;
21257c478bd9Sstevel@tonic-gate } else {
21267c478bd9Sstevel@tonic-gate if (mp->b_cont != NULL)
21277c478bd9Sstevel@tonic-gate mp1->b_cont = mp->b_cont;
21287c478bd9Sstevel@tonic-gate freeb(mp);
21297c478bd9Sstevel@tonic-gate }
21307c478bd9Sstevel@tonic-gate
21317c478bd9Sstevel@tonic-gate ipha = (ipha_t *)(mp1->b_rptr + iph_hdr_length + sizeof (icmph_t));
21327c478bd9Sstevel@tonic-gate ipha->ipha_protocol = nexthdr;
21337c478bd9Sstevel@tonic-gate length = ntohs(ipha->ipha_length);
21347c478bd9Sstevel@tonic-gate length -= ah_length;
21357c478bd9Sstevel@tonic-gate ipha->ipha_length = htons((uint16_t)length);
21367c478bd9Sstevel@tonic-gate ipha->ipha_hdr_checksum = 0;
21377c478bd9Sstevel@tonic-gate ipha->ipha_hdr_checksum = (uint16_t)ip_csum_hdr(ipha);
21387c478bd9Sstevel@tonic-gate
2139bd670b35SErik Nordmark return (mp1);
21407c478bd9Sstevel@tonic-gate }
21417c478bd9Sstevel@tonic-gate
21427c478bd9Sstevel@tonic-gate /*
21437c478bd9Sstevel@tonic-gate * IP calls this to validate the ICMP errors that
21447c478bd9Sstevel@tonic-gate * we got from the network.
21457c478bd9Sstevel@tonic-gate */
2146bd670b35SErik Nordmark mblk_t *
ipsecah_icmp_error(mblk_t * data_mp,ip_recv_attr_t * ira)2147bd670b35SErik Nordmark ipsecah_icmp_error(mblk_t *data_mp, ip_recv_attr_t *ira)
21487c478bd9Sstevel@tonic-gate {
2149bd670b35SErik Nordmark netstack_t *ns = ira->ira_ill->ill_ipst->ips_netstack;
2150f4b3ec61Sdh ipsecah_stack_t *ahstack = ns->netstack_ipsecah;
21517c478bd9Sstevel@tonic-gate
2152bd670b35SErik Nordmark if (ira->ira_flags & IRAF_IS_IPV4)
2153bd670b35SErik Nordmark return (ah_icmp_error_v4(data_mp, ira, ahstack));
21547c478bd9Sstevel@tonic-gate else
2155bd670b35SErik Nordmark return (ah_icmp_error_v6(data_mp, ira, ahstack));
21567c478bd9Sstevel@tonic-gate }
21577c478bd9Sstevel@tonic-gate
21587c478bd9Sstevel@tonic-gate static int
ah_fix_tlv_options_v6(uint8_t * oi_opt,uint8_t * pi_opt,uint_t ehdrlen,uint8_t hdr_type,boolean_t copy_always)21597c478bd9Sstevel@tonic-gate ah_fix_tlv_options_v6(uint8_t *oi_opt, uint8_t *pi_opt, uint_t ehdrlen,
21607c478bd9Sstevel@tonic-gate uint8_t hdr_type, boolean_t copy_always)
21617c478bd9Sstevel@tonic-gate {
21627c478bd9Sstevel@tonic-gate uint8_t opt_type;
21637c478bd9Sstevel@tonic-gate uint_t optlen;
21647c478bd9Sstevel@tonic-gate
21657c478bd9Sstevel@tonic-gate ASSERT(hdr_type == IPPROTO_DSTOPTS || hdr_type == IPPROTO_HOPOPTS);
21667c478bd9Sstevel@tonic-gate
21677c478bd9Sstevel@tonic-gate /*
21687c478bd9Sstevel@tonic-gate * Copy the next header and hdr ext. len of the HOP-by-HOP
21697c478bd9Sstevel@tonic-gate * and Destination option.
21707c478bd9Sstevel@tonic-gate */
21717c478bd9Sstevel@tonic-gate *pi_opt++ = *oi_opt++;
21727c478bd9Sstevel@tonic-gate *pi_opt++ = *oi_opt++;
21737c478bd9Sstevel@tonic-gate ehdrlen -= 2;
21747c478bd9Sstevel@tonic-gate
21757c478bd9Sstevel@tonic-gate /*
21767c478bd9Sstevel@tonic-gate * Now handle all the TLV encoded options.
21777c478bd9Sstevel@tonic-gate */
21787c478bd9Sstevel@tonic-gate while (ehdrlen != 0) {
21797c478bd9Sstevel@tonic-gate opt_type = *oi_opt;
21807c478bd9Sstevel@tonic-gate
21817c478bd9Sstevel@tonic-gate if (opt_type == IP6OPT_PAD1) {
21827c478bd9Sstevel@tonic-gate optlen = 1;
21837c478bd9Sstevel@tonic-gate } else {
21847c478bd9Sstevel@tonic-gate if (ehdrlen < 2)
21857c478bd9Sstevel@tonic-gate goto bad_opt;
21867c478bd9Sstevel@tonic-gate optlen = 2 + oi_opt[1];
21877c478bd9Sstevel@tonic-gate if (optlen > ehdrlen)
21887c478bd9Sstevel@tonic-gate goto bad_opt;
21897c478bd9Sstevel@tonic-gate }
21907c478bd9Sstevel@tonic-gate if (copy_always || !(opt_type & IP6OPT_MUTABLE)) {
21917c478bd9Sstevel@tonic-gate bcopy(oi_opt, pi_opt, optlen);
21927c478bd9Sstevel@tonic-gate } else {
21937c478bd9Sstevel@tonic-gate if (optlen == 1) {
21947c478bd9Sstevel@tonic-gate *pi_opt = 0;
21957c478bd9Sstevel@tonic-gate } else {
21967c478bd9Sstevel@tonic-gate /*
21977c478bd9Sstevel@tonic-gate * Copy the type and data length fields.
21987c478bd9Sstevel@tonic-gate * Zero the option data by skipping
21997c478bd9Sstevel@tonic-gate * option type and option data len
22007c478bd9Sstevel@tonic-gate * fields.
22017c478bd9Sstevel@tonic-gate */
22027c478bd9Sstevel@tonic-gate *pi_opt = *oi_opt;
22037c478bd9Sstevel@tonic-gate *(pi_opt + 1) = *(oi_opt + 1);
22047c478bd9Sstevel@tonic-gate bzero(pi_opt + 2, optlen - 2);
22057c478bd9Sstevel@tonic-gate }
22067c478bd9Sstevel@tonic-gate }
22077c478bd9Sstevel@tonic-gate ehdrlen -= optlen;
22087c478bd9Sstevel@tonic-gate oi_opt += optlen;
22097c478bd9Sstevel@tonic-gate pi_opt += optlen;
22107c478bd9Sstevel@tonic-gate }
22117c478bd9Sstevel@tonic-gate return (0);
22127c478bd9Sstevel@tonic-gate bad_opt:
22137c478bd9Sstevel@tonic-gate return (-1);
22147c478bd9Sstevel@tonic-gate }
22157c478bd9Sstevel@tonic-gate
22167c478bd9Sstevel@tonic-gate /*
22177c478bd9Sstevel@tonic-gate * Construct a pseudo header for AH, processing all the options.
22187c478bd9Sstevel@tonic-gate *
22197c478bd9Sstevel@tonic-gate * oip6h is the IPv6 header of the incoming or outgoing packet.
22207c478bd9Sstevel@tonic-gate * ip6h is the pointer to the pseudo headers IPV6 header. All
22217c478bd9Sstevel@tonic-gate * the space needed for the options have been allocated including
22227c478bd9Sstevel@tonic-gate * the AH header.
22237c478bd9Sstevel@tonic-gate *
22247c478bd9Sstevel@tonic-gate * If copy_always is set, all the options that appear before AH are copied
22257c478bd9Sstevel@tonic-gate * blindly without checking for IP6OPT_MUTABLE. This is used by
22267c478bd9Sstevel@tonic-gate * ah_auth_out_done(). Please refer to that function for details.
22277c478bd9Sstevel@tonic-gate *
22287c478bd9Sstevel@tonic-gate * NOTE :
22297c478bd9Sstevel@tonic-gate *
22307c478bd9Sstevel@tonic-gate * * AH header is never copied in this function even if copy_always
22317c478bd9Sstevel@tonic-gate * is set. It just returns the ah_offset - offset of the AH header
22327c478bd9Sstevel@tonic-gate * and the caller needs to do the copying. This is done so that we
22337c478bd9Sstevel@tonic-gate * don't have pass extra arguments e.g. SA etc. and also,
22347c478bd9Sstevel@tonic-gate * it is not needed when ah_auth_out_done is calling this function.
22357c478bd9Sstevel@tonic-gate */
22367c478bd9Sstevel@tonic-gate static uint_t
ah_fix_phdr_v6(ip6_t * ip6h,ip6_t * oip6h,boolean_t outbound,boolean_t copy_always)22377c478bd9Sstevel@tonic-gate ah_fix_phdr_v6(ip6_t *ip6h, ip6_t *oip6h, boolean_t outbound,
22387c478bd9Sstevel@tonic-gate boolean_t copy_always)
22397c478bd9Sstevel@tonic-gate {
22407c478bd9Sstevel@tonic-gate uint8_t *oi_opt;
22417c478bd9Sstevel@tonic-gate uint8_t *pi_opt;
22427c478bd9Sstevel@tonic-gate uint8_t nexthdr;
22437c478bd9Sstevel@tonic-gate uint8_t *prev_nexthdr;
22447c478bd9Sstevel@tonic-gate ip6_hbh_t *hbhhdr;
22457c478bd9Sstevel@tonic-gate ip6_dest_t *dsthdr = NULL;
22467c478bd9Sstevel@tonic-gate ip6_rthdr0_t *rthdr;
22477c478bd9Sstevel@tonic-gate int ehdrlen;
22487c478bd9Sstevel@tonic-gate ah_t *ah;
22497c478bd9Sstevel@tonic-gate int ret;
22507c478bd9Sstevel@tonic-gate
22517c478bd9Sstevel@tonic-gate /*
22527c478bd9Sstevel@tonic-gate * In the outbound case for source route, ULP has already moved
22537c478bd9Sstevel@tonic-gate * the first hop, which is now in ip6_dst. We need to re-arrange
22547c478bd9Sstevel@tonic-gate * the header to make it look like how it would appear in the
22557c478bd9Sstevel@tonic-gate * receiver i.e
22567c478bd9Sstevel@tonic-gate *
22577c478bd9Sstevel@tonic-gate * Because of ip_massage_options_v6 the header looks like
22587c478bd9Sstevel@tonic-gate * this :
22597c478bd9Sstevel@tonic-gate *
22607c478bd9Sstevel@tonic-gate * ip6_src = S, ip6_dst = I1. followed by I2,I3,D.
22617c478bd9Sstevel@tonic-gate *
22627c478bd9Sstevel@tonic-gate * When it reaches the receiver, it would look like
22637c478bd9Sstevel@tonic-gate *
22647c478bd9Sstevel@tonic-gate * ip6_src = S, ip6_dst = D. followed by I1,I2,I3.
22657c478bd9Sstevel@tonic-gate *
22667c478bd9Sstevel@tonic-gate * NOTE : We assume that there are no problems with the options
22677c478bd9Sstevel@tonic-gate * as IP should have already checked this.
22687c478bd9Sstevel@tonic-gate */
22697c478bd9Sstevel@tonic-gate
22707c478bd9Sstevel@tonic-gate oi_opt = (uchar_t *)&oip6h[1];
22717c478bd9Sstevel@tonic-gate pi_opt = (uchar_t *)&ip6h[1];
22727c478bd9Sstevel@tonic-gate
22737c478bd9Sstevel@tonic-gate /*
22747c478bd9Sstevel@tonic-gate * We set the prev_nexthdr properly in the pseudo header.
22757c478bd9Sstevel@tonic-gate * After we finish authentication and come back from the
22767c478bd9Sstevel@tonic-gate * algorithm module, pseudo header will become the real
22777c478bd9Sstevel@tonic-gate * IP header.
22787c478bd9Sstevel@tonic-gate */
22797c478bd9Sstevel@tonic-gate prev_nexthdr = (uint8_t *)&ip6h->ip6_nxt;
22807c478bd9Sstevel@tonic-gate nexthdr = oip6h->ip6_nxt;
22817c478bd9Sstevel@tonic-gate /* Assume IP has already stripped it */
2282bd670b35SErik Nordmark ASSERT(nexthdr != IPPROTO_FRAGMENT);
22837c478bd9Sstevel@tonic-gate ah = NULL;
22847c478bd9Sstevel@tonic-gate dsthdr = NULL;
22857c478bd9Sstevel@tonic-gate for (;;) {
22867c478bd9Sstevel@tonic-gate switch (nexthdr) {
22877c478bd9Sstevel@tonic-gate case IPPROTO_HOPOPTS:
22887c478bd9Sstevel@tonic-gate hbhhdr = (ip6_hbh_t *)oi_opt;
22897c478bd9Sstevel@tonic-gate nexthdr = hbhhdr->ip6h_nxt;
22907c478bd9Sstevel@tonic-gate ehdrlen = 8 * (hbhhdr->ip6h_len + 1);
22917c478bd9Sstevel@tonic-gate ret = ah_fix_tlv_options_v6(oi_opt, pi_opt, ehdrlen,
22927c478bd9Sstevel@tonic-gate IPPROTO_HOPOPTS, copy_always);
22937c478bd9Sstevel@tonic-gate /*
22947c478bd9Sstevel@tonic-gate * Return a zero offset indicating error if there
22957c478bd9Sstevel@tonic-gate * was error.
22967c478bd9Sstevel@tonic-gate */
22977c478bd9Sstevel@tonic-gate if (ret == -1)
22987c478bd9Sstevel@tonic-gate return (0);
22997c478bd9Sstevel@tonic-gate hbhhdr = (ip6_hbh_t *)pi_opt;
23007c478bd9Sstevel@tonic-gate prev_nexthdr = (uint8_t *)&hbhhdr->ip6h_nxt;
23017c478bd9Sstevel@tonic-gate break;
23027c478bd9Sstevel@tonic-gate case IPPROTO_ROUTING:
23037c478bd9Sstevel@tonic-gate rthdr = (ip6_rthdr0_t *)oi_opt;
23047c478bd9Sstevel@tonic-gate nexthdr = rthdr->ip6r0_nxt;
23057c478bd9Sstevel@tonic-gate ehdrlen = 8 * (rthdr->ip6r0_len + 1);
23067c478bd9Sstevel@tonic-gate if (!copy_always && outbound) {
23077c478bd9Sstevel@tonic-gate int i, left;
23087c478bd9Sstevel@tonic-gate ip6_rthdr0_t *prthdr;
23097c478bd9Sstevel@tonic-gate in6_addr_t *ap, *pap;
23107c478bd9Sstevel@tonic-gate
23117c478bd9Sstevel@tonic-gate left = rthdr->ip6r0_segleft;
23127c478bd9Sstevel@tonic-gate prthdr = (ip6_rthdr0_t *)pi_opt;
23137c478bd9Sstevel@tonic-gate pap = (in6_addr_t *)(prthdr + 1);
23147c478bd9Sstevel@tonic-gate ap = (in6_addr_t *)(rthdr + 1);
23157c478bd9Sstevel@tonic-gate /*
23167c478bd9Sstevel@tonic-gate * First eight bytes except seg_left
23177c478bd9Sstevel@tonic-gate * does not change en route.
23187c478bd9Sstevel@tonic-gate */
23197c478bd9Sstevel@tonic-gate bcopy(oi_opt, pi_opt, 8);
23207c478bd9Sstevel@tonic-gate prthdr->ip6r0_segleft = 0;
23217c478bd9Sstevel@tonic-gate /*
23227c478bd9Sstevel@tonic-gate * First address has been moved to
23237c478bd9Sstevel@tonic-gate * the destination address of the
23247c478bd9Sstevel@tonic-gate * ip header by ip_massage_options_v6.
23257c478bd9Sstevel@tonic-gate * And the real destination address is
23267c478bd9Sstevel@tonic-gate * in the last address part of the
23277c478bd9Sstevel@tonic-gate * option.
23287c478bd9Sstevel@tonic-gate */
23297c478bd9Sstevel@tonic-gate *pap = oip6h->ip6_dst;
23307c478bd9Sstevel@tonic-gate for (i = 1; i < left - 1; i++)
23317c478bd9Sstevel@tonic-gate pap[i] = ap[i - 1];
23327c478bd9Sstevel@tonic-gate ip6h->ip6_dst = *(ap + left - 1);
23337c478bd9Sstevel@tonic-gate } else {
23347c478bd9Sstevel@tonic-gate bcopy(oi_opt, pi_opt, ehdrlen);
23357c478bd9Sstevel@tonic-gate }
23367c478bd9Sstevel@tonic-gate rthdr = (ip6_rthdr0_t *)pi_opt;
23377c478bd9Sstevel@tonic-gate prev_nexthdr = (uint8_t *)&rthdr->ip6r0_nxt;
23387c478bd9Sstevel@tonic-gate break;
23397c478bd9Sstevel@tonic-gate case IPPROTO_DSTOPTS:
23407c478bd9Sstevel@tonic-gate /*
23417c478bd9Sstevel@tonic-gate * Destination options are tricky. If there is
23427c478bd9Sstevel@tonic-gate * a terminal (e.g. non-IPv6-extension) header
23437c478bd9Sstevel@tonic-gate * following the destination options, don't
23447c478bd9Sstevel@tonic-gate * reset prev_nexthdr or advance the AH insertion
23457c478bd9Sstevel@tonic-gate * point and just treat this as a terminal header.
23467c478bd9Sstevel@tonic-gate *
23477c478bd9Sstevel@tonic-gate * If this is an inbound packet, just deal with
23487c478bd9Sstevel@tonic-gate * it as is.
23497c478bd9Sstevel@tonic-gate */
23507c478bd9Sstevel@tonic-gate dsthdr = (ip6_dest_t *)oi_opt;
23517c478bd9Sstevel@tonic-gate /*
23527c478bd9Sstevel@tonic-gate * XXX I hope common-subexpression elimination
23537c478bd9Sstevel@tonic-gate * saves us the double-evaluate.
23547c478bd9Sstevel@tonic-gate */
23557c478bd9Sstevel@tonic-gate if (outbound && dsthdr->ip6d_nxt != IPPROTO_ROUTING &&
23567c478bd9Sstevel@tonic-gate dsthdr->ip6d_nxt != IPPROTO_HOPOPTS)
23577c478bd9Sstevel@tonic-gate goto terminal_hdr;
23587c478bd9Sstevel@tonic-gate nexthdr = dsthdr->ip6d_nxt;
23597c478bd9Sstevel@tonic-gate ehdrlen = 8 * (dsthdr->ip6d_len + 1);
23607c478bd9Sstevel@tonic-gate ret = ah_fix_tlv_options_v6(oi_opt, pi_opt, ehdrlen,
23617c478bd9Sstevel@tonic-gate IPPROTO_DSTOPTS, copy_always);
23627c478bd9Sstevel@tonic-gate /*
23637c478bd9Sstevel@tonic-gate * Return a zero offset indicating error if there
23647c478bd9Sstevel@tonic-gate * was error.
23657c478bd9Sstevel@tonic-gate */
23667c478bd9Sstevel@tonic-gate if (ret == -1)
23677c478bd9Sstevel@tonic-gate return (0);
23687c478bd9Sstevel@tonic-gate break;
23697c478bd9Sstevel@tonic-gate case IPPROTO_AH:
23707c478bd9Sstevel@tonic-gate /*
23717c478bd9Sstevel@tonic-gate * Be conservative in what you send. We shouldn't
23727c478bd9Sstevel@tonic-gate * see two same-scoped AH's in one packet.
23737c478bd9Sstevel@tonic-gate * (Inner-IP-scoped AH will be hit by terminal
23747c478bd9Sstevel@tonic-gate * header of IP or IPv6.)
23757c478bd9Sstevel@tonic-gate */
23767c478bd9Sstevel@tonic-gate ASSERT(!outbound);
23777c478bd9Sstevel@tonic-gate return ((uint_t)(pi_opt - (uint8_t *)ip6h));
23787c478bd9Sstevel@tonic-gate default:
23797c478bd9Sstevel@tonic-gate ASSERT(outbound);
23807c478bd9Sstevel@tonic-gate terminal_hdr:
23817c478bd9Sstevel@tonic-gate *prev_nexthdr = IPPROTO_AH;
23827c478bd9Sstevel@tonic-gate ah = (ah_t *)pi_opt;
23837c478bd9Sstevel@tonic-gate ah->ah_nexthdr = nexthdr;
23847c478bd9Sstevel@tonic-gate return ((uint_t)(pi_opt - (uint8_t *)ip6h));
23857c478bd9Sstevel@tonic-gate }
23867c478bd9Sstevel@tonic-gate pi_opt += ehdrlen;
23877c478bd9Sstevel@tonic-gate oi_opt += ehdrlen;
23887c478bd9Sstevel@tonic-gate }
23897c478bd9Sstevel@tonic-gate /* NOTREACHED */
23907c478bd9Sstevel@tonic-gate }
23917c478bd9Sstevel@tonic-gate
23927c478bd9Sstevel@tonic-gate static boolean_t
ah_finish_up(ah_t * phdr_ah,ah_t * inbound_ah,ipsa_t * assoc,int ah_data_sz,int ah_align_sz,ipsecah_stack_t * ahstack)23937c478bd9Sstevel@tonic-gate ah_finish_up(ah_t *phdr_ah, ah_t *inbound_ah, ipsa_t *assoc,
2394f4b3ec61Sdh int ah_data_sz, int ah_align_sz, ipsecah_stack_t *ahstack)
23957c478bd9Sstevel@tonic-gate {
23967c478bd9Sstevel@tonic-gate int i;
23977c478bd9Sstevel@tonic-gate
23987c478bd9Sstevel@tonic-gate /*
23997c478bd9Sstevel@tonic-gate * Padding :
24007c478bd9Sstevel@tonic-gate *
24017c478bd9Sstevel@tonic-gate * 1) Authentication data may have to be padded
24027c478bd9Sstevel@tonic-gate * before ICV calculation if ICV is not a multiple
24037c478bd9Sstevel@tonic-gate * of 64 bits. This padding is arbitrary and transmitted
24047c478bd9Sstevel@tonic-gate * with the packet at the end of the authentication data.
24057c478bd9Sstevel@tonic-gate * Payload length should include the padding bytes.
24067c478bd9Sstevel@tonic-gate *
24077c478bd9Sstevel@tonic-gate * 2) Explicit padding of the whole datagram may be
24087c478bd9Sstevel@tonic-gate * required by the algorithm which need not be
24097c478bd9Sstevel@tonic-gate * transmitted. It is assumed that this will be taken
24107c478bd9Sstevel@tonic-gate * care by the algorithm module.
24117c478bd9Sstevel@tonic-gate */
24127c478bd9Sstevel@tonic-gate bzero(phdr_ah + 1, ah_data_sz); /* Zero out ICV for pseudo-hdr. */
24137c478bd9Sstevel@tonic-gate
24147c478bd9Sstevel@tonic-gate if (inbound_ah == NULL) {
24157c478bd9Sstevel@tonic-gate /* Outbound AH datagram. */
24167c478bd9Sstevel@tonic-gate
24177c478bd9Sstevel@tonic-gate phdr_ah->ah_length = (ah_align_sz >> 2) + 1;
24187c478bd9Sstevel@tonic-gate phdr_ah->ah_reserved = 0;
24197c478bd9Sstevel@tonic-gate phdr_ah->ah_spi = assoc->ipsa_spi;
24207c478bd9Sstevel@tonic-gate
24217c478bd9Sstevel@tonic-gate phdr_ah->ah_replay =
24221a5e258fSJosef 'Jeff' Sipek htonl(atomic_inc_32_nv(&assoc->ipsa_replay));
24237c478bd9Sstevel@tonic-gate if (phdr_ah->ah_replay == 0 && assoc->ipsa_replay_wsize != 0) {
24247c478bd9Sstevel@tonic-gate /*
24257c478bd9Sstevel@tonic-gate * XXX We have replay counter wrapping. We probably
24267c478bd9Sstevel@tonic-gate * want to nuke this SA (and its peer).
24277c478bd9Sstevel@tonic-gate */
24287c478bd9Sstevel@tonic-gate ipsec_assocfailure(info.mi_idnum, 0, 0,
24297c478bd9Sstevel@tonic-gate SL_ERROR | SL_CONSOLE | SL_WARN,
24307c478bd9Sstevel@tonic-gate "Outbound AH SA (0x%x), dst %s has wrapped "
24317c478bd9Sstevel@tonic-gate "sequence.\n", phdr_ah->ah_spi,
2432f4b3ec61Sdh assoc->ipsa_dstaddr, assoc->ipsa_addrfam,
2433f4b3ec61Sdh ahstack->ipsecah_netstack);
24347c478bd9Sstevel@tonic-gate
24357c478bd9Sstevel@tonic-gate sadb_replay_delete(assoc);
24367c478bd9Sstevel@tonic-gate /* Caller will free phdr_mp and return NULL. */
24377c478bd9Sstevel@tonic-gate return (B_FALSE);
24387c478bd9Sstevel@tonic-gate }
24397c478bd9Sstevel@tonic-gate
24407c478bd9Sstevel@tonic-gate if (ah_data_sz != ah_align_sz) {
24417c478bd9Sstevel@tonic-gate uchar_t *pad = ((uchar_t *)phdr_ah + sizeof (ah_t) +
24427c478bd9Sstevel@tonic-gate ah_data_sz);
24437c478bd9Sstevel@tonic-gate
24447c478bd9Sstevel@tonic-gate for (i = 0; i < (ah_align_sz - ah_data_sz); i++) {
24457c478bd9Sstevel@tonic-gate pad[i] = (uchar_t)i; /* Fill the padding */
24467c478bd9Sstevel@tonic-gate }
24477c478bd9Sstevel@tonic-gate }
24487c478bd9Sstevel@tonic-gate } else {
24497c478bd9Sstevel@tonic-gate /* Inbound AH datagram. */
24507c478bd9Sstevel@tonic-gate phdr_ah->ah_nexthdr = inbound_ah->ah_nexthdr;
24517c478bd9Sstevel@tonic-gate phdr_ah->ah_length = inbound_ah->ah_length;
24527c478bd9Sstevel@tonic-gate phdr_ah->ah_reserved = 0;
24537c478bd9Sstevel@tonic-gate ASSERT(inbound_ah->ah_spi == assoc->ipsa_spi);
24547c478bd9Sstevel@tonic-gate phdr_ah->ah_spi = inbound_ah->ah_spi;
24557c478bd9Sstevel@tonic-gate phdr_ah->ah_replay = inbound_ah->ah_replay;
24567c478bd9Sstevel@tonic-gate
24577c478bd9Sstevel@tonic-gate if (ah_data_sz != ah_align_sz) {
2458f4b3ec61Sdh uchar_t *opad = ((uchar_t *)inbound_ah +
2459f4b3ec61Sdh sizeof (ah_t) + ah_data_sz);
24607c478bd9Sstevel@tonic-gate uchar_t *pad = ((uchar_t *)phdr_ah + sizeof (ah_t) +
24617c478bd9Sstevel@tonic-gate ah_data_sz);
24627c478bd9Sstevel@tonic-gate
24637c478bd9Sstevel@tonic-gate for (i = 0; i < (ah_align_sz - ah_data_sz); i++) {
24647c478bd9Sstevel@tonic-gate pad[i] = opad[i]; /* Copy the padding */
24657c478bd9Sstevel@tonic-gate }
24667c478bd9Sstevel@tonic-gate }
24677c478bd9Sstevel@tonic-gate }
24687c478bd9Sstevel@tonic-gate
24697c478bd9Sstevel@tonic-gate return (B_TRUE);
24707c478bd9Sstevel@tonic-gate }
24717c478bd9Sstevel@tonic-gate
24727c478bd9Sstevel@tonic-gate /*
24737c478bd9Sstevel@tonic-gate * Called upon failing the inbound ICV check. The message passed as
24747c478bd9Sstevel@tonic-gate * argument is freed.
24757c478bd9Sstevel@tonic-gate */
24767c478bd9Sstevel@tonic-gate static void
ah_log_bad_auth(mblk_t * mp,ip_recv_attr_t * ira,ipsec_crypto_t * ic)2477bd670b35SErik Nordmark ah_log_bad_auth(mblk_t *mp, ip_recv_attr_t *ira, ipsec_crypto_t *ic)
24787c478bd9Sstevel@tonic-gate {
2479bd670b35SErik Nordmark boolean_t isv4 = (ira->ira_flags & IRAF_IS_IPV4);
2480bd670b35SErik Nordmark ipsa_t *assoc = ira->ira_ipsec_ah_sa;
2481bd670b35SErik Nordmark int af;
2482bd670b35SErik Nordmark void *addr;
2483bd670b35SErik Nordmark netstack_t *ns = ira->ira_ill->ill_ipst->ips_netstack;
2484f4b3ec61Sdh ipsecah_stack_t *ahstack = ns->netstack_ipsecah;
2485f4b3ec61Sdh ipsec_stack_t *ipss = ns->netstack_ipsec;
24867c478bd9Sstevel@tonic-gate
2487bd670b35SErik Nordmark ASSERT(mp->b_datap->db_type == M_DATA);
2488bd670b35SErik Nordmark
2489bd670b35SErik Nordmark mp->b_rptr -= ic->ic_skip_len;
24907c478bd9Sstevel@tonic-gate
24917c478bd9Sstevel@tonic-gate if (isv4) {
24927c478bd9Sstevel@tonic-gate ipha_t *ipha = (ipha_t *)mp->b_rptr;
24937c478bd9Sstevel@tonic-gate addr = &ipha->ipha_dst;
24947c478bd9Sstevel@tonic-gate af = AF_INET;
24957c478bd9Sstevel@tonic-gate } else {
24967c478bd9Sstevel@tonic-gate ip6_t *ip6h = (ip6_t *)mp->b_rptr;
24977c478bd9Sstevel@tonic-gate addr = &ip6h->ip6_dst;
24987c478bd9Sstevel@tonic-gate af = AF_INET6;
24997c478bd9Sstevel@tonic-gate }
25007c478bd9Sstevel@tonic-gate
25017c478bd9Sstevel@tonic-gate /*
25027c478bd9Sstevel@tonic-gate * Log the event. Don't print to the console, block
25037c478bd9Sstevel@tonic-gate * potential denial-of-service attack.
25047c478bd9Sstevel@tonic-gate */
2505f4b3ec61Sdh AH_BUMP_STAT(ahstack, bad_auth);
25067c478bd9Sstevel@tonic-gate
25077c478bd9Sstevel@tonic-gate ipsec_assocfailure(info.mi_idnum, 0, 0, SL_ERROR | SL_WARN,
25087c478bd9Sstevel@tonic-gate "AH Authentication failed spi %x, dst_addr %s",
2509f4b3ec61Sdh assoc->ipsa_spi, addr, af, ahstack->ipsecah_netstack);
25107c478bd9Sstevel@tonic-gate
2511f4b3ec61Sdh IP_AH_BUMP_STAT(ipss, in_discards);
2512bd670b35SErik Nordmark ip_drop_packet(mp, B_TRUE, ira->ira_ill,
2513f4b3ec61Sdh DROPPER(ipss, ipds_ah_bad_auth),
2514f4b3ec61Sdh &ahstack->ah_dropper);
25157c478bd9Sstevel@tonic-gate }
25167c478bd9Sstevel@tonic-gate
25177c478bd9Sstevel@tonic-gate /*
25187c478bd9Sstevel@tonic-gate * Kernel crypto framework callback invoked after completion of async
2519bd670b35SErik Nordmark * crypto requests for outbound packets.
25207c478bd9Sstevel@tonic-gate */
25217c478bd9Sstevel@tonic-gate static void
ah_kcf_callback_outbound(void * arg,int status)2522bd670b35SErik Nordmark ah_kcf_callback_outbound(void *arg, int status)
25237c478bd9Sstevel@tonic-gate {
2524bd670b35SErik Nordmark mblk_t *mp = (mblk_t *)arg;
2525bd670b35SErik Nordmark mblk_t *async_mp;
2526bd670b35SErik Nordmark netstack_t *ns;
2527f4b3ec61Sdh ipsec_stack_t *ipss;
2528f4b3ec61Sdh ipsecah_stack_t *ahstack;
2529bd670b35SErik Nordmark mblk_t *data_mp;
2530bd670b35SErik Nordmark ip_xmit_attr_t ixas;
2531bd670b35SErik Nordmark ipsec_crypto_t *ic;
2532bd670b35SErik Nordmark ill_t *ill;
2533bd670b35SErik Nordmark
2534bd670b35SErik Nordmark /*
2535bd670b35SErik Nordmark * First remove the ipsec_crypto_t mblk
2536bd670b35SErik Nordmark * Note that we need to ipsec_free_crypto_data(mp) once done with ic.
2537bd670b35SErik Nordmark */
2538bd670b35SErik Nordmark async_mp = ipsec_remove_crypto_data(mp, &ic);
2539bd670b35SErik Nordmark ASSERT(async_mp != NULL);
2540bd670b35SErik Nordmark
2541bd670b35SErik Nordmark /*
2542bd670b35SErik Nordmark * Extract the ip_xmit_attr_t from the first mblk.
2543bd670b35SErik Nordmark * Verifies that the netstack and ill is still around; could
2544bd670b35SErik Nordmark * have vanished while kEf was doing its work.
2545bd670b35SErik Nordmark * On succesful return we have a nce_t and the ill/ipst can't
2546bd670b35SErik Nordmark * disappear until we do the nce_refrele in ixa_cleanup.
2547bd670b35SErik Nordmark */
2548bd670b35SErik Nordmark data_mp = async_mp->b_cont;
2549bd670b35SErik Nordmark async_mp->b_cont = NULL;
2550bd670b35SErik Nordmark if (!ip_xmit_attr_from_mblk(async_mp, &ixas)) {
2551bd670b35SErik Nordmark /* Disappeared on us - no ill/ipst for MIB */
2552bd670b35SErik Nordmark if (ixas.ixa_nce != NULL) {
2553bd670b35SErik Nordmark ill = ixas.ixa_nce->nce_ill;
2554bd670b35SErik Nordmark BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
2555bd670b35SErik Nordmark ip_drop_output("ipIfStatsOutDiscards", data_mp, ill);
2556bd670b35SErik Nordmark }
2557bd670b35SErik Nordmark freemsg(data_mp);
2558bd670b35SErik Nordmark goto done;
2559bd670b35SErik Nordmark }
2560bd670b35SErik Nordmark ns = ixas.ixa_ipst->ips_netstack;
2561bd670b35SErik Nordmark ahstack = ns->netstack_ipsecah;
2562bd670b35SErik Nordmark ipss = ns->netstack_ipsec;
2563bd670b35SErik Nordmark ill = ixas.ixa_nce->nce_ill;
25647c478bd9Sstevel@tonic-gate
2565bd670b35SErik Nordmark if (status == CRYPTO_SUCCESS) {
2566bd670b35SErik Nordmark data_mp = ah_auth_out_done(data_mp, &ixas, ic);
2567bd670b35SErik Nordmark if (data_mp == NULL)
2568bd670b35SErik Nordmark goto done;
25697c478bd9Sstevel@tonic-gate
2570bd670b35SErik Nordmark (void) ip_output_post_ipsec(data_mp, &ixas);
2571f4b3ec61Sdh } else {
2572bd670b35SErik Nordmark /* Outbound shouldn't see invalid MAC */
2573bd670b35SErik Nordmark ASSERT(status != CRYPTO_INVALID_MAC);
2574bd670b35SErik Nordmark
2575bd670b35SErik Nordmark ah1dbg(ahstack,
2576bd670b35SErik Nordmark ("ah_kcf_callback_outbound: crypto failed with 0x%x\n",
2577bd670b35SErik Nordmark status));
2578bd670b35SErik Nordmark AH_BUMP_STAT(ahstack, crypto_failures);
2579bd670b35SErik Nordmark AH_BUMP_STAT(ahstack, out_discards);
2580bd670b35SErik Nordmark
2581bd670b35SErik Nordmark ip_drop_packet(data_mp, B_FALSE, ill,
2582bd670b35SErik Nordmark DROPPER(ipss, ipds_ah_crypto_failed),
2583bd670b35SErik Nordmark &ahstack->ah_dropper);
2584bd670b35SErik Nordmark BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
2585f4b3ec61Sdh }
2586bd670b35SErik Nordmark done:
2587bd670b35SErik Nordmark ixa_cleanup(&ixas);
2588bd670b35SErik Nordmark (void) ipsec_free_crypto_data(mp);
2589bd670b35SErik Nordmark }
2590bd670b35SErik Nordmark
2591bd670b35SErik Nordmark /*
2592bd670b35SErik Nordmark * Kernel crypto framework callback invoked after completion of async
2593bd670b35SErik Nordmark * crypto requests for inbound packets.
2594bd670b35SErik Nordmark */
2595bd670b35SErik Nordmark static void
ah_kcf_callback_inbound(void * arg,int status)2596bd670b35SErik Nordmark ah_kcf_callback_inbound(void *arg, int status)
2597bd670b35SErik Nordmark {
2598bd670b35SErik Nordmark mblk_t *mp = (mblk_t *)arg;
2599bd670b35SErik Nordmark mblk_t *async_mp;
2600bd670b35SErik Nordmark netstack_t *ns;
2601bd670b35SErik Nordmark ipsec_stack_t *ipss;
2602bd670b35SErik Nordmark ipsecah_stack_t *ahstack;
2603bd670b35SErik Nordmark mblk_t *data_mp;
2604bd670b35SErik Nordmark ip_recv_attr_t iras;
2605bd670b35SErik Nordmark ipsec_crypto_t *ic;
2606bd670b35SErik Nordmark
2607f4b3ec61Sdh /*
2608bd670b35SErik Nordmark * First remove the ipsec_crypto_t mblk
2609bd670b35SErik Nordmark * Note that we need to ipsec_free_crypto_data(mp) once done with ic.
2610f4b3ec61Sdh */
2611bd670b35SErik Nordmark async_mp = ipsec_remove_crypto_data(mp, &ic);
2612bd670b35SErik Nordmark ASSERT(async_mp != NULL);
2613f4b3ec61Sdh
2614bd670b35SErik Nordmark /*
2615bd670b35SErik Nordmark * Extract the ip_xmit_attr_t from the first mblk.
2616bd670b35SErik Nordmark * Verifies that the netstack and ill is still around; could
2617bd670b35SErik Nordmark * have vanished while kEf was doing its work.
2618bd670b35SErik Nordmark */
2619bd670b35SErik Nordmark data_mp = async_mp->b_cont;
2620bd670b35SErik Nordmark async_mp->b_cont = NULL;
2621bd670b35SErik Nordmark if (!ip_recv_attr_from_mblk(async_mp, &iras)) {
2622bd670b35SErik Nordmark /* The ill or ip_stack_t disappeared on us */
2623bd670b35SErik Nordmark ip_drop_input("ip_recv_attr_from_mblk", data_mp, NULL);
2624bd670b35SErik Nordmark freemsg(data_mp);
2625bd670b35SErik Nordmark goto done;
2626bd670b35SErik Nordmark }
2627bd670b35SErik Nordmark ns = iras.ira_ill->ill_ipst->ips_netstack;
2628f4b3ec61Sdh ahstack = ns->netstack_ipsecah;
2629f4b3ec61Sdh ipss = ns->netstack_ipsec;
2630f4b3ec61Sdh
26317c478bd9Sstevel@tonic-gate if (status == CRYPTO_SUCCESS) {
2632bd670b35SErik Nordmark data_mp = ah_auth_in_done(data_mp, &iras, ic);
2633bd670b35SErik Nordmark if (data_mp == NULL)
2634bd670b35SErik Nordmark goto done;
26357c478bd9Sstevel@tonic-gate
2636bd670b35SErik Nordmark /* finish IPsec processing */
2637bd670b35SErik Nordmark ip_input_post_ipsec(data_mp, &iras);
26387c478bd9Sstevel@tonic-gate
26397c478bd9Sstevel@tonic-gate } else if (status == CRYPTO_INVALID_MAC) {
2640bd670b35SErik Nordmark ah_log_bad_auth(data_mp, &iras, ic);
26417c478bd9Sstevel@tonic-gate } else {
2642bd670b35SErik Nordmark ah1dbg(ahstack,
2643bd670b35SErik Nordmark ("ah_kcf_callback_inbound: crypto failed with 0x%x\n",
2644437220cdSdanmcd status));
2645f4b3ec61Sdh AH_BUMP_STAT(ahstack, crypto_failures);
2646bd670b35SErik Nordmark IP_AH_BUMP_STAT(ipss, in_discards);
2647bd670b35SErik Nordmark ip_drop_packet(data_mp, B_TRUE, iras.ira_ill,
2648f4b3ec61Sdh DROPPER(ipss, ipds_ah_crypto_failed),
2649f4b3ec61Sdh &ahstack->ah_dropper);
2650bd670b35SErik Nordmark BUMP_MIB(iras.ira_ill->ill_ip_mib, ipIfStatsInDiscards);
26517c478bd9Sstevel@tonic-gate }
2652bd670b35SErik Nordmark done:
2653bd670b35SErik Nordmark ira_cleanup(&iras, B_TRUE);
2654bd670b35SErik Nordmark (void) ipsec_free_crypto_data(mp);
26557c478bd9Sstevel@tonic-gate }
26567c478bd9Sstevel@tonic-gate
26577c478bd9Sstevel@tonic-gate /*
26587c478bd9Sstevel@tonic-gate * Invoked on kernel crypto failure during inbound and outbound processing.
26597c478bd9Sstevel@tonic-gate */
26607c478bd9Sstevel@tonic-gate static void
ah_crypto_failed(mblk_t * data_mp,boolean_t is_inbound,int kef_rc,ill_t * ill,ipsecah_stack_t * ahstack)2661bd670b35SErik Nordmark ah_crypto_failed(mblk_t *data_mp, boolean_t is_inbound, int kef_rc,
2662bd670b35SErik Nordmark ill_t *ill, ipsecah_stack_t *ahstack)
26637c478bd9Sstevel@tonic-gate {
2664f4b3ec61Sdh ipsec_stack_t *ipss = ahstack->ipsecah_netstack->netstack_ipsec;
2665f4b3ec61Sdh
2666f4b3ec61Sdh ah1dbg(ahstack, ("crypto failed for %s AH with 0x%x\n",
26677c478bd9Sstevel@tonic-gate is_inbound ? "inbound" : "outbound", kef_rc));
2668bd670b35SErik Nordmark ip_drop_packet(data_mp, is_inbound, ill,
2669f4b3ec61Sdh DROPPER(ipss, ipds_ah_crypto_failed),
2670f4b3ec61Sdh &ahstack->ah_dropper);
2671f4b3ec61Sdh AH_BUMP_STAT(ahstack, crypto_failures);
26727c478bd9Sstevel@tonic-gate if (is_inbound)
2673f4b3ec61Sdh IP_AH_BUMP_STAT(ipss, in_discards);
26747c478bd9Sstevel@tonic-gate else
2675f4b3ec61Sdh AH_BUMP_STAT(ahstack, out_discards);
26767c478bd9Sstevel@tonic-gate }
26777c478bd9Sstevel@tonic-gate
26787c478bd9Sstevel@tonic-gate /*
26797c478bd9Sstevel@tonic-gate * Helper macros for the ah_submit_req_{inbound,outbound}() functions.
26807c478bd9Sstevel@tonic-gate */
26817c478bd9Sstevel@tonic-gate
2682bd670b35SErik Nordmark /*
2683bd670b35SErik Nordmark * A statement-equivalent macro, _cr MUST point to a modifiable
2684bd670b35SErik Nordmark * crypto_call_req_t.
2685bd670b35SErik Nordmark */
2686bd670b35SErik Nordmark #define AH_INIT_CALLREQ(_cr, _mp, _callback) \
2687bd670b35SErik Nordmark (_cr)->cr_flag = CRYPTO_SKIP_REQID|CRYPTO_ALWAYS_QUEUE; \
2688bd670b35SErik Nordmark (_cr)->cr_callback_arg = (_mp); \
2689bd670b35SErik Nordmark (_cr)->cr_callback_func = (_callback)
26907c478bd9Sstevel@tonic-gate
26917c478bd9Sstevel@tonic-gate #define AH_INIT_CRYPTO_DATA(data, msglen, mblk) { \
26927c478bd9Sstevel@tonic-gate (data)->cd_format = CRYPTO_DATA_MBLK; \
26937c478bd9Sstevel@tonic-gate (data)->cd_mp = mblk; \
26947c478bd9Sstevel@tonic-gate (data)->cd_offset = 0; \
26957c478bd9Sstevel@tonic-gate (data)->cd_length = msglen; \
26967c478bd9Sstevel@tonic-gate }
26977c478bd9Sstevel@tonic-gate
26987c478bd9Sstevel@tonic-gate #define AH_INIT_CRYPTO_MAC(mac, icvlen, icvbuf) { \
26997c478bd9Sstevel@tonic-gate (mac)->cd_format = CRYPTO_DATA_RAW; \
27007c478bd9Sstevel@tonic-gate (mac)->cd_offset = 0; \
27017c478bd9Sstevel@tonic-gate (mac)->cd_length = icvlen; \
27027c478bd9Sstevel@tonic-gate (mac)->cd_raw.iov_base = icvbuf; \
27037c478bd9Sstevel@tonic-gate (mac)->cd_raw.iov_len = icvlen; \
27047c478bd9Sstevel@tonic-gate }
27057c478bd9Sstevel@tonic-gate
27067c478bd9Sstevel@tonic-gate /*
27077c478bd9Sstevel@tonic-gate * Submit an inbound packet for processing by the crypto framework.
27087c478bd9Sstevel@tonic-gate */
2709bd670b35SErik Nordmark static mblk_t *
ah_submit_req_inbound(mblk_t * phdr_mp,ip_recv_attr_t * ira,size_t skip_len,uint32_t ah_offset,ipsa_t * assoc)2710bd670b35SErik Nordmark ah_submit_req_inbound(mblk_t *phdr_mp, ip_recv_attr_t *ira,
2711bd670b35SErik Nordmark size_t skip_len, uint32_t ah_offset, ipsa_t *assoc)
27127c478bd9Sstevel@tonic-gate {
27137c478bd9Sstevel@tonic-gate int kef_rc;
2714bd670b35SErik Nordmark mblk_t *mp;
2715bd670b35SErik Nordmark crypto_call_req_t call_req, *callrp;
27167c478bd9Sstevel@tonic-gate uint_t icv_len = assoc->ipsa_mac_len;
27177c478bd9Sstevel@tonic-gate crypto_ctx_template_t ctx_tmpl;
2718bd670b35SErik Nordmark ipsecah_stack_t *ahstack;
2719bd670b35SErik Nordmark ipsec_crypto_t *ic, icstack;
2720bd670b35SErik Nordmark boolean_t force = (assoc->ipsa_flags & IPSA_F_ASYNC);
2721bd670b35SErik Nordmark
2722bd670b35SErik Nordmark ahstack = ira->ira_ill->ill_ipst->ips_netstack->netstack_ipsecah;
27237c478bd9Sstevel@tonic-gate
27247c478bd9Sstevel@tonic-gate ASSERT(phdr_mp != NULL);
2725bd670b35SErik Nordmark ASSERT(phdr_mp->b_datap->db_type == M_DATA);
2726bd670b35SErik Nordmark
2727bd670b35SErik Nordmark if (force) {
2728bd670b35SErik Nordmark /* We are doing asynch; allocate mblks to hold state */
2729bd670b35SErik Nordmark if ((mp = ip_recv_attr_to_mblk(ira)) == NULL ||
2730bd670b35SErik Nordmark (mp = ipsec_add_crypto_data(mp, &ic)) == NULL) {
2731bd670b35SErik Nordmark BUMP_MIB(ira->ira_ill->ill_ip_mib, ipIfStatsInDiscards);
2732bd670b35SErik Nordmark ip_drop_input("ipIfStatsInDiscards", phdr_mp,
2733bd670b35SErik Nordmark ira->ira_ill);
2734bd670b35SErik Nordmark freemsg(phdr_mp);
2735bd670b35SErik Nordmark return (NULL);
2736bd670b35SErik Nordmark }
27377c478bd9Sstevel@tonic-gate
2738bd670b35SErik Nordmark linkb(mp, phdr_mp);
2739bd670b35SErik Nordmark callrp = &call_req;
2740bd670b35SErik Nordmark AH_INIT_CALLREQ(callrp, mp, ah_kcf_callback_inbound);
2741bd670b35SErik Nordmark } else {
2742bd670b35SErik Nordmark /*
2743bd670b35SErik Nordmark * If we know we are going to do sync then ipsec_crypto_t
2744bd670b35SErik Nordmark * should be on the stack.
2745bd670b35SErik Nordmark */
2746bd670b35SErik Nordmark ic = &icstack;
2747bd670b35SErik Nordmark bzero(ic, sizeof (*ic));
2748bd670b35SErik Nordmark callrp = NULL;
2749bd670b35SErik Nordmark }
2750f4b3ec61Sdh
27517c478bd9Sstevel@tonic-gate /* init arguments for the crypto framework */
2752bd670b35SErik Nordmark AH_INIT_CRYPTO_DATA(&ic->ic_crypto_data, AH_MSGSIZE(phdr_mp),
27537c478bd9Sstevel@tonic-gate phdr_mp);
27547c478bd9Sstevel@tonic-gate
2755bd670b35SErik Nordmark AH_INIT_CRYPTO_MAC(&ic->ic_crypto_mac, icv_len,
27567c478bd9Sstevel@tonic-gate (char *)phdr_mp->b_cont->b_rptr - skip_len + ah_offset +
27577c478bd9Sstevel@tonic-gate sizeof (ah_t));
27587c478bd9Sstevel@tonic-gate
2759bd670b35SErik Nordmark ic->ic_skip_len = skip_len;
27607c478bd9Sstevel@tonic-gate
27617c478bd9Sstevel@tonic-gate IPSEC_CTX_TMPL(assoc, ipsa_authtmpl, IPSEC_ALG_AUTH, ctx_tmpl);
27627c478bd9Sstevel@tonic-gate
27637c478bd9Sstevel@tonic-gate /* call KEF to do the MAC operation */
27647c478bd9Sstevel@tonic-gate kef_rc = crypto_mac_verify(&assoc->ipsa_amech,
2765bd670b35SErik Nordmark &ic->ic_crypto_data, &assoc->ipsa_kcfauthkey, ctx_tmpl,
2766bd670b35SErik Nordmark &ic->ic_crypto_mac, callrp);
27677c478bd9Sstevel@tonic-gate
27687c478bd9Sstevel@tonic-gate switch (kef_rc) {
27697c478bd9Sstevel@tonic-gate case CRYPTO_SUCCESS:
2770f4b3ec61Sdh AH_BUMP_STAT(ahstack, crypto_sync);
2771bd670b35SErik Nordmark phdr_mp = ah_auth_in_done(phdr_mp, ira, ic);
2772bd670b35SErik Nordmark if (force) {
2773bd670b35SErik Nordmark /* Free mp after we are done with ic */
2774bd670b35SErik Nordmark mp = ipsec_free_crypto_data(mp);
2775bd670b35SErik Nordmark (void) ip_recv_attr_free_mblk(mp);
2776bd670b35SErik Nordmark }
2777bd670b35SErik Nordmark return (phdr_mp);
27787c478bd9Sstevel@tonic-gate case CRYPTO_QUEUED:
2779bd670b35SErik Nordmark /* ah_kcf_callback_inbound() will be invoked on completion */
2780f4b3ec61Sdh AH_BUMP_STAT(ahstack, crypto_async);
2781bd670b35SErik Nordmark return (NULL);
27827c478bd9Sstevel@tonic-gate case CRYPTO_INVALID_MAC:
2783bd670b35SErik Nordmark /* Free mp after we are done with ic */
2784f4b3ec61Sdh AH_BUMP_STAT(ahstack, crypto_sync);
2785bd670b35SErik Nordmark BUMP_MIB(ira->ira_ill->ill_ip_mib, ipIfStatsInDiscards);
2786bd670b35SErik Nordmark ah_log_bad_auth(phdr_mp, ira, ic);
2787bd670b35SErik Nordmark /* phdr_mp was passed to ip_drop_packet */
2788bd670b35SErik Nordmark if (force) {
2789bd670b35SErik Nordmark mp = ipsec_free_crypto_data(mp);
2790bd670b35SErik Nordmark (void) ip_recv_attr_free_mblk(mp);
2791bd670b35SErik Nordmark }
2792bd670b35SErik Nordmark return (NULL);
27937c478bd9Sstevel@tonic-gate }
27947c478bd9Sstevel@tonic-gate
2795bd670b35SErik Nordmark if (force) {
2796bd670b35SErik Nordmark mp = ipsec_free_crypto_data(mp);
2797bd670b35SErik Nordmark phdr_mp = ip_recv_attr_free_mblk(mp);
2798bd670b35SErik Nordmark }
2799bd670b35SErik Nordmark BUMP_MIB(ira->ira_ill->ill_ip_mib, ipIfStatsInDiscards);
2800bd670b35SErik Nordmark ah_crypto_failed(phdr_mp, B_TRUE, kef_rc, ira->ira_ill, ahstack);
2801bd670b35SErik Nordmark /* phdr_mp was passed to ip_drop_packet */
2802bd670b35SErik Nordmark return (NULL);
28037c478bd9Sstevel@tonic-gate }
28047c478bd9Sstevel@tonic-gate
28057c478bd9Sstevel@tonic-gate /*
28067c478bd9Sstevel@tonic-gate * Submit an outbound packet for processing by the crypto framework.
28077c478bd9Sstevel@tonic-gate */
2808bd670b35SErik Nordmark static mblk_t *
ah_submit_req_outbound(mblk_t * phdr_mp,ip_xmit_attr_t * ixa,size_t skip_len,ipsa_t * assoc)2809bd670b35SErik Nordmark ah_submit_req_outbound(mblk_t *phdr_mp, ip_xmit_attr_t *ixa,
2810bd670b35SErik Nordmark size_t skip_len, ipsa_t *assoc)
28117c478bd9Sstevel@tonic-gate {
28127c478bd9Sstevel@tonic-gate int kef_rc;
2813bd670b35SErik Nordmark mblk_t *mp;
2814bd670b35SErik Nordmark crypto_call_req_t call_req, *callrp;
28157c478bd9Sstevel@tonic-gate uint_t icv_len = assoc->ipsa_mac_len;
2816bd670b35SErik Nordmark ipsecah_stack_t *ahstack;
2817bd670b35SErik Nordmark ipsec_crypto_t *ic, icstack;
2818bd670b35SErik Nordmark ill_t *ill = ixa->ixa_nce->nce_ill;
2819bd670b35SErik Nordmark boolean_t force = (assoc->ipsa_flags & IPSA_F_ASYNC);
28207c478bd9Sstevel@tonic-gate
2821bd670b35SErik Nordmark ahstack = ill->ill_ipst->ips_netstack->netstack_ipsecah;
28227c478bd9Sstevel@tonic-gate
2823bd670b35SErik Nordmark ASSERT(phdr_mp != NULL);
2824bd670b35SErik Nordmark ASSERT(phdr_mp->b_datap->db_type == M_DATA);
2825bd670b35SErik Nordmark
2826bd670b35SErik Nordmark if (force) {
2827bd670b35SErik Nordmark /* We are doing asynch; allocate mblks to hold state */
2828bd670b35SErik Nordmark if ((mp = ip_xmit_attr_to_mblk(ixa)) == NULL ||
2829bd670b35SErik Nordmark (mp = ipsec_add_crypto_data(mp, &ic)) == NULL) {
2830bd670b35SErik Nordmark BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
2831bd670b35SErik Nordmark ip_drop_output("ipIfStatsOutDiscards", phdr_mp, ill);
2832bd670b35SErik Nordmark freemsg(phdr_mp);
2833bd670b35SErik Nordmark return (NULL);
2834bd670b35SErik Nordmark }
2835bd670b35SErik Nordmark linkb(mp, phdr_mp);
2836bd670b35SErik Nordmark callrp = &call_req;
2837bd670b35SErik Nordmark AH_INIT_CALLREQ(callrp, mp, ah_kcf_callback_outbound);
2838bd670b35SErik Nordmark } else {
2839bd670b35SErik Nordmark /*
2840bd670b35SErik Nordmark * If we know we are going to do sync then ipsec_crypto_t
2841bd670b35SErik Nordmark * should be on the stack.
2842bd670b35SErik Nordmark */
2843bd670b35SErik Nordmark ic = &icstack;
2844bd670b35SErik Nordmark bzero(ic, sizeof (*ic));
2845bd670b35SErik Nordmark callrp = NULL;
2846bd670b35SErik Nordmark }
2847f4b3ec61Sdh
28487c478bd9Sstevel@tonic-gate /* init arguments for the crypto framework */
2849bd670b35SErik Nordmark AH_INIT_CRYPTO_DATA(&ic->ic_crypto_data, AH_MSGSIZE(phdr_mp),
28507c478bd9Sstevel@tonic-gate phdr_mp);
28517c478bd9Sstevel@tonic-gate
2852bd670b35SErik Nordmark AH_INIT_CRYPTO_MAC(&ic->ic_crypto_mac, icv_len,
28537c478bd9Sstevel@tonic-gate (char *)phdr_mp->b_wptr);
28547c478bd9Sstevel@tonic-gate
2855bd670b35SErik Nordmark ic->ic_skip_len = skip_len;
28567c478bd9Sstevel@tonic-gate
2857bd670b35SErik Nordmark ASSERT(ixa->ixa_ipsec_ah_sa != NULL);
28587c478bd9Sstevel@tonic-gate
28597c478bd9Sstevel@tonic-gate /* call KEF to do the MAC operation */
2860bd670b35SErik Nordmark kef_rc = crypto_mac(&assoc->ipsa_amech, &ic->ic_crypto_data,
28617c478bd9Sstevel@tonic-gate &assoc->ipsa_kcfauthkey, assoc->ipsa_authtmpl,
2862bd670b35SErik Nordmark &ic->ic_crypto_mac, callrp);
28637c478bd9Sstevel@tonic-gate
28647c478bd9Sstevel@tonic-gate switch (kef_rc) {
28657c478bd9Sstevel@tonic-gate case CRYPTO_SUCCESS:
2866f4b3ec61Sdh AH_BUMP_STAT(ahstack, crypto_sync);
2867bd670b35SErik Nordmark phdr_mp = ah_auth_out_done(phdr_mp, ixa, ic);
2868bd670b35SErik Nordmark if (force) {
2869bd670b35SErik Nordmark /* Free mp after we are done with ic */
2870bd670b35SErik Nordmark mp = ipsec_free_crypto_data(mp);
2871bd670b35SErik Nordmark (void) ip_xmit_attr_free_mblk(mp);
2872bd670b35SErik Nordmark }
2873bd670b35SErik Nordmark return (phdr_mp);
28747c478bd9Sstevel@tonic-gate case CRYPTO_QUEUED:
2875bd670b35SErik Nordmark /* ah_kcf_callback_outbound() will be invoked on completion */
2876f4b3ec61Sdh AH_BUMP_STAT(ahstack, crypto_async);
2877bd670b35SErik Nordmark return (NULL);
28787c478bd9Sstevel@tonic-gate }
28797c478bd9Sstevel@tonic-gate
2880bd670b35SErik Nordmark if (force) {
2881bd670b35SErik Nordmark mp = ipsec_free_crypto_data(mp);
2882bd670b35SErik Nordmark phdr_mp = ip_xmit_attr_free_mblk(mp);
2883bd670b35SErik Nordmark }
2884bd670b35SErik Nordmark BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
2885bd670b35SErik Nordmark ah_crypto_failed(phdr_mp, B_FALSE, kef_rc, NULL, ahstack);
2886bd670b35SErik Nordmark /* phdr_mp was passed to ip_drop_packet */
2887bd670b35SErik Nordmark return (NULL);
28887c478bd9Sstevel@tonic-gate }
28897c478bd9Sstevel@tonic-gate
28907c478bd9Sstevel@tonic-gate /*
28917c478bd9Sstevel@tonic-gate * This function constructs a pseudo header by looking at the IP header
28927c478bd9Sstevel@tonic-gate * and options if any. This is called for both outbound and inbound,
28937c478bd9Sstevel@tonic-gate * before computing the ICV.
28947c478bd9Sstevel@tonic-gate */
28957c478bd9Sstevel@tonic-gate static mblk_t *
ah_process_ip_options_v6(mblk_t * mp,ipsa_t * assoc,int * length_to_skip,uint_t ah_data_sz,boolean_t outbound,ipsecah_stack_t * ahstack)28967c478bd9Sstevel@tonic-gate ah_process_ip_options_v6(mblk_t *mp, ipsa_t *assoc, int *length_to_skip,
2897f4b3ec61Sdh uint_t ah_data_sz, boolean_t outbound, ipsecah_stack_t *ahstack)
28987c478bd9Sstevel@tonic-gate {
28997c478bd9Sstevel@tonic-gate ip6_t *ip6h;
29007c478bd9Sstevel@tonic-gate ip6_t *oip6h;
2901d81c80caSToomas Soome mblk_t *phdr_mp;
29027c478bd9Sstevel@tonic-gate int option_length;
29037c478bd9Sstevel@tonic-gate uint_t ah_align_sz;
29047c478bd9Sstevel@tonic-gate uint_t ah_offset;
29057c478bd9Sstevel@tonic-gate int hdr_size;
29067c478bd9Sstevel@tonic-gate
29077c478bd9Sstevel@tonic-gate /*
29087c478bd9Sstevel@tonic-gate * Allocate space for the authentication data also. It is
29097c478bd9Sstevel@tonic-gate * useful both during the ICV calculation where we need to
29107c478bd9Sstevel@tonic-gate * feed in zeroes and while sending the datagram back to IP
29117c478bd9Sstevel@tonic-gate * where we will be using the same space.
29127c478bd9Sstevel@tonic-gate *
29137c478bd9Sstevel@tonic-gate * We need to allocate space for padding bytes if it is not
29147c478bd9Sstevel@tonic-gate * a multiple of IPV6_PADDING_ALIGN.
29157c478bd9Sstevel@tonic-gate *
29167c478bd9Sstevel@tonic-gate * In addition, we allocate space for the ICV computed by
29177c478bd9Sstevel@tonic-gate * the kernel crypto framework, saving us a separate kmem
29187c478bd9Sstevel@tonic-gate * allocation down the road.
29197c478bd9Sstevel@tonic-gate */
29207c478bd9Sstevel@tonic-gate
29217c478bd9Sstevel@tonic-gate ah_align_sz = P2ALIGN(ah_data_sz + IPV6_PADDING_ALIGN - 1,
29227c478bd9Sstevel@tonic-gate IPV6_PADDING_ALIGN);
29237c478bd9Sstevel@tonic-gate
29247c478bd9Sstevel@tonic-gate ASSERT(ah_align_sz >= ah_data_sz);
29257c478bd9Sstevel@tonic-gate
29267c478bd9Sstevel@tonic-gate hdr_size = ipsec_ah_get_hdr_size_v6(mp, B_FALSE);
29277c478bd9Sstevel@tonic-gate option_length = hdr_size - IPV6_HDR_LEN;
29287c478bd9Sstevel@tonic-gate
29297c478bd9Sstevel@tonic-gate /* This was not included in ipsec_ah_get_hdr_size_v6() */
29307c478bd9Sstevel@tonic-gate hdr_size += (sizeof (ah_t) + ah_align_sz);
29317c478bd9Sstevel@tonic-gate
29327c478bd9Sstevel@tonic-gate if (!outbound && (MBLKL(mp) < hdr_size)) {
29337c478bd9Sstevel@tonic-gate /*
29347c478bd9Sstevel@tonic-gate * We have post-AH header options in a separate mblk,
29357c478bd9Sstevel@tonic-gate * a pullup is required.
29367c478bd9Sstevel@tonic-gate */
29377c478bd9Sstevel@tonic-gate if (!pullupmsg(mp, hdr_size))
29387c478bd9Sstevel@tonic-gate return (NULL);
29397c478bd9Sstevel@tonic-gate }
29407c478bd9Sstevel@tonic-gate
2941de8c4a14SErik Nordmark if ((phdr_mp = allocb_tmpl(hdr_size + ah_data_sz, mp)) == NULL) {
29427c478bd9Sstevel@tonic-gate return (NULL);
29437c478bd9Sstevel@tonic-gate }
29447c478bd9Sstevel@tonic-gate
29457c478bd9Sstevel@tonic-gate oip6h = (ip6_t *)mp->b_rptr;
29467c478bd9Sstevel@tonic-gate
29477c478bd9Sstevel@tonic-gate /*
29487c478bd9Sstevel@tonic-gate * Form the basic IP header first. Zero out the header
29497c478bd9Sstevel@tonic-gate * so that the mutable fields are zeroed out.
29507c478bd9Sstevel@tonic-gate */
29517c478bd9Sstevel@tonic-gate ip6h = (ip6_t *)phdr_mp->b_rptr;
29527c478bd9Sstevel@tonic-gate bzero(ip6h, sizeof (ip6_t));
29537c478bd9Sstevel@tonic-gate ip6h->ip6_vcf = IPV6_DEFAULT_VERS_AND_FLOW;
29547c478bd9Sstevel@tonic-gate
29557c478bd9Sstevel@tonic-gate if (outbound) {
29567c478bd9Sstevel@tonic-gate /*
29577c478bd9Sstevel@tonic-gate * Include the size of AH and authentication data.
29587c478bd9Sstevel@tonic-gate * This is how our recipient would compute the
29597c478bd9Sstevel@tonic-gate * authentication data. Look at what we do in the
29607c478bd9Sstevel@tonic-gate * inbound case below.
29617c478bd9Sstevel@tonic-gate */
29627c478bd9Sstevel@tonic-gate ip6h->ip6_plen = htons(ntohs(oip6h->ip6_plen) +
29637c478bd9Sstevel@tonic-gate sizeof (ah_t) + ah_align_sz);
29647c478bd9Sstevel@tonic-gate } else {
29657c478bd9Sstevel@tonic-gate ip6h->ip6_plen = oip6h->ip6_plen;
29667c478bd9Sstevel@tonic-gate }
29677c478bd9Sstevel@tonic-gate
29687c478bd9Sstevel@tonic-gate ip6h->ip6_src = oip6h->ip6_src;
29697c478bd9Sstevel@tonic-gate ip6h->ip6_dst = oip6h->ip6_dst;
29707c478bd9Sstevel@tonic-gate
29717c478bd9Sstevel@tonic-gate *length_to_skip = IPV6_HDR_LEN;
29727c478bd9Sstevel@tonic-gate if (option_length == 0) {
29737c478bd9Sstevel@tonic-gate /* Form the AH header */
29747c478bd9Sstevel@tonic-gate ip6h->ip6_nxt = IPPROTO_AH;
29757c478bd9Sstevel@tonic-gate ((ah_t *)(ip6h + 1))->ah_nexthdr = oip6h->ip6_nxt;
29767c478bd9Sstevel@tonic-gate ah_offset = *length_to_skip;
29777c478bd9Sstevel@tonic-gate } else {
29787c478bd9Sstevel@tonic-gate ip6h->ip6_nxt = oip6h->ip6_nxt;
29797c478bd9Sstevel@tonic-gate /* option_length does not include the AH header's size */
29807c478bd9Sstevel@tonic-gate *length_to_skip += option_length;
29817c478bd9Sstevel@tonic-gate
29827c478bd9Sstevel@tonic-gate ah_offset = ah_fix_phdr_v6(ip6h, oip6h, outbound, B_FALSE);
29837c478bd9Sstevel@tonic-gate if (ah_offset == 0) {
29847c478bd9Sstevel@tonic-gate return (NULL);
29857c478bd9Sstevel@tonic-gate }
29867c478bd9Sstevel@tonic-gate }
29877c478bd9Sstevel@tonic-gate
29887c478bd9Sstevel@tonic-gate if (!ah_finish_up(((ah_t *)((uint8_t *)ip6h + ah_offset)),
29897c478bd9Sstevel@tonic-gate (outbound ? NULL : ((ah_t *)((uint8_t *)oip6h + ah_offset))),
2990f4b3ec61Sdh assoc, ah_data_sz, ah_align_sz, ahstack)) {
29917c478bd9Sstevel@tonic-gate freeb(phdr_mp);
29927c478bd9Sstevel@tonic-gate /*
29937c478bd9Sstevel@tonic-gate * Returning NULL will tell the caller to
29947c478bd9Sstevel@tonic-gate * IPSA_REFELE(), free the memory, etc.
29957c478bd9Sstevel@tonic-gate */
29967c478bd9Sstevel@tonic-gate return (NULL);
29977c478bd9Sstevel@tonic-gate }
29987c478bd9Sstevel@tonic-gate
29997c478bd9Sstevel@tonic-gate phdr_mp->b_wptr = ((uint8_t *)ip6h + ah_offset + sizeof (ah_t) +
30007c478bd9Sstevel@tonic-gate ah_align_sz);
30017c478bd9Sstevel@tonic-gate if (!outbound)
30027c478bd9Sstevel@tonic-gate *length_to_skip += sizeof (ah_t) + ah_align_sz;
30037c478bd9Sstevel@tonic-gate return (phdr_mp);
30047c478bd9Sstevel@tonic-gate }
30057c478bd9Sstevel@tonic-gate
30067c478bd9Sstevel@tonic-gate /*
30077c478bd9Sstevel@tonic-gate * This function constructs a pseudo header by looking at the IP header
30087c478bd9Sstevel@tonic-gate * and options if any. This is called for both outbound and inbound,
30097c478bd9Sstevel@tonic-gate * before computing the ICV.
30107c478bd9Sstevel@tonic-gate */
30117c478bd9Sstevel@tonic-gate static mblk_t *
ah_process_ip_options_v4(mblk_t * mp,ipsa_t * assoc,int * length_to_skip,uint_t ah_data_sz,boolean_t outbound,ipsecah_stack_t * ahstack)30127c478bd9Sstevel@tonic-gate ah_process_ip_options_v4(mblk_t *mp, ipsa_t *assoc, int *length_to_skip,
3013f4b3ec61Sdh uint_t ah_data_sz, boolean_t outbound, ipsecah_stack_t *ahstack)
30147c478bd9Sstevel@tonic-gate {
30157c478bd9Sstevel@tonic-gate ipoptp_t opts;
30167c478bd9Sstevel@tonic-gate uint32_t option_length;
30177c478bd9Sstevel@tonic-gate ipha_t *ipha;
30187c478bd9Sstevel@tonic-gate ipha_t *oipha;
3019d81c80caSToomas Soome mblk_t *phdr_mp;
30207c478bd9Sstevel@tonic-gate int size;
30217c478bd9Sstevel@tonic-gate uchar_t *optptr;
30227c478bd9Sstevel@tonic-gate uint8_t optval;
30237c478bd9Sstevel@tonic-gate uint8_t optlen;
30247c478bd9Sstevel@tonic-gate ipaddr_t dst;
30257c478bd9Sstevel@tonic-gate uint32_t v_hlen_tos_len;
30267c478bd9Sstevel@tonic-gate int ip_hdr_length;
30277c478bd9Sstevel@tonic-gate uint_t ah_align_sz;
30287c478bd9Sstevel@tonic-gate uint32_t off;
30297c478bd9Sstevel@tonic-gate
30307c478bd9Sstevel@tonic-gate #ifdef _BIG_ENDIAN
30317c478bd9Sstevel@tonic-gate #define V_HLEN (v_hlen_tos_len >> 24)
30327c478bd9Sstevel@tonic-gate #else
30337c478bd9Sstevel@tonic-gate #define V_HLEN (v_hlen_tos_len & 0xFF)
30347c478bd9Sstevel@tonic-gate #endif
30357c478bd9Sstevel@tonic-gate
30367c478bd9Sstevel@tonic-gate oipha = (ipha_t *)mp->b_rptr;
30377c478bd9Sstevel@tonic-gate v_hlen_tos_len = ((uint32_t *)oipha)[0];
30387c478bd9Sstevel@tonic-gate
30397c478bd9Sstevel@tonic-gate /*
30407c478bd9Sstevel@tonic-gate * Allocate space for the authentication data also. It is
30417c478bd9Sstevel@tonic-gate * useful both during the ICV calculation where we need to
30427c478bd9Sstevel@tonic-gate * feed in zeroes and while sending the datagram back to IP
30437c478bd9Sstevel@tonic-gate * where we will be using the same space.
30447c478bd9Sstevel@tonic-gate *
30457c478bd9Sstevel@tonic-gate * We need to allocate space for padding bytes if it is not
30467c478bd9Sstevel@tonic-gate * a multiple of IPV4_PADDING_ALIGN.
30477c478bd9Sstevel@tonic-gate *
30487c478bd9Sstevel@tonic-gate * In addition, we allocate space for the ICV computed by
30497c478bd9Sstevel@tonic-gate * the kernel crypto framework, saving us a separate kmem
30507c478bd9Sstevel@tonic-gate * allocation down the road.
30517c478bd9Sstevel@tonic-gate */
30527c478bd9Sstevel@tonic-gate
30537c478bd9Sstevel@tonic-gate ah_align_sz = P2ALIGN(ah_data_sz + IPV4_PADDING_ALIGN - 1,
30547c478bd9Sstevel@tonic-gate IPV4_PADDING_ALIGN);
30557c478bd9Sstevel@tonic-gate
30567c478bd9Sstevel@tonic-gate ASSERT(ah_align_sz >= ah_data_sz);
30577c478bd9Sstevel@tonic-gate
30587c478bd9Sstevel@tonic-gate size = IP_SIMPLE_HDR_LENGTH + sizeof (ah_t) + ah_align_sz +
30597c478bd9Sstevel@tonic-gate ah_data_sz;
30607c478bd9Sstevel@tonic-gate
30617c478bd9Sstevel@tonic-gate if (V_HLEN != IP_SIMPLE_HDR_VERSION) {
30627c478bd9Sstevel@tonic-gate option_length = oipha->ipha_version_and_hdr_length -
30637c478bd9Sstevel@tonic-gate (uint8_t)((IP_VERSION << 4) +
30647c478bd9Sstevel@tonic-gate IP_SIMPLE_HDR_LENGTH_IN_WORDS);
30657c478bd9Sstevel@tonic-gate option_length <<= 2;
30667c478bd9Sstevel@tonic-gate size += option_length;
30677c478bd9Sstevel@tonic-gate }
30687c478bd9Sstevel@tonic-gate
3069de8c4a14SErik Nordmark if ((phdr_mp = allocb_tmpl(size, mp)) == NULL) {
30707c478bd9Sstevel@tonic-gate return (NULL);
30717c478bd9Sstevel@tonic-gate }
30727c478bd9Sstevel@tonic-gate
30737c478bd9Sstevel@tonic-gate /*
30747c478bd9Sstevel@tonic-gate * Form the basic IP header first.
30757c478bd9Sstevel@tonic-gate */
30767c478bd9Sstevel@tonic-gate ipha = (ipha_t *)phdr_mp->b_rptr;
30777c478bd9Sstevel@tonic-gate ipha->ipha_version_and_hdr_length = oipha->ipha_version_and_hdr_length;
30787c478bd9Sstevel@tonic-gate ipha->ipha_type_of_service = 0;
30797c478bd9Sstevel@tonic-gate
30807c478bd9Sstevel@tonic-gate if (outbound) {
30817c478bd9Sstevel@tonic-gate /*
30827c478bd9Sstevel@tonic-gate * Include the size of AH and authentication data.
30837c478bd9Sstevel@tonic-gate * This is how our recipient would compute the
30847c478bd9Sstevel@tonic-gate * authentication data. Look at what we do in the
30857c478bd9Sstevel@tonic-gate * inbound case below.
30867c478bd9Sstevel@tonic-gate */
30877c478bd9Sstevel@tonic-gate ipha->ipha_length = ntohs(htons(oipha->ipha_length) +
30887c478bd9Sstevel@tonic-gate sizeof (ah_t) + ah_align_sz);
30897c478bd9Sstevel@tonic-gate } else {
30907c478bd9Sstevel@tonic-gate ipha->ipha_length = oipha->ipha_length;
30917c478bd9Sstevel@tonic-gate }
30927c478bd9Sstevel@tonic-gate
30937c478bd9Sstevel@tonic-gate ipha->ipha_ident = oipha->ipha_ident;
30947c478bd9Sstevel@tonic-gate ipha->ipha_fragment_offset_and_flags = 0;
30957c478bd9Sstevel@tonic-gate ipha->ipha_ttl = 0;
30967c478bd9Sstevel@tonic-gate ipha->ipha_protocol = IPPROTO_AH;
30977c478bd9Sstevel@tonic-gate ipha->ipha_hdr_checksum = 0;
30987c478bd9Sstevel@tonic-gate ipha->ipha_src = oipha->ipha_src;
30997c478bd9Sstevel@tonic-gate ipha->ipha_dst = dst = oipha->ipha_dst;
31007c478bd9Sstevel@tonic-gate
31017c478bd9Sstevel@tonic-gate /*
31027c478bd9Sstevel@tonic-gate * If there is no option to process return now.
31037c478bd9Sstevel@tonic-gate */
31047c478bd9Sstevel@tonic-gate ip_hdr_length = IP_SIMPLE_HDR_LENGTH;
31057c478bd9Sstevel@tonic-gate
31067c478bd9Sstevel@tonic-gate if (V_HLEN == IP_SIMPLE_HDR_VERSION) {
31077c478bd9Sstevel@tonic-gate /* Form the AH header */
31087c478bd9Sstevel@tonic-gate goto ah_hdr;
31097c478bd9Sstevel@tonic-gate }
31107c478bd9Sstevel@tonic-gate
31117c478bd9Sstevel@tonic-gate ip_hdr_length += option_length;
31127c478bd9Sstevel@tonic-gate
31137c478bd9Sstevel@tonic-gate /*
31147c478bd9Sstevel@tonic-gate * We have options. In the outbound case for source route,
31157c478bd9Sstevel@tonic-gate * ULP has already moved the first hop, which is now in
31167c478bd9Sstevel@tonic-gate * ipha_dst. We need the final destination for the calculation
31177c478bd9Sstevel@tonic-gate * of authentication data. And also make sure that mutable
31187c478bd9Sstevel@tonic-gate * and experimental fields are zeroed out in the IP options.
31197c478bd9Sstevel@tonic-gate */
31207c478bd9Sstevel@tonic-gate
31217c478bd9Sstevel@tonic-gate bcopy(&oipha[1], &ipha[1], option_length);
31227c478bd9Sstevel@tonic-gate
31237c478bd9Sstevel@tonic-gate for (optval = ipoptp_first(&opts, ipha);
31247c478bd9Sstevel@tonic-gate optval != IPOPT_EOL;
31257c478bd9Sstevel@tonic-gate optval = ipoptp_next(&opts)) {
31267c478bd9Sstevel@tonic-gate optptr = opts.ipoptp_cur;
31277c478bd9Sstevel@tonic-gate optlen = opts.ipoptp_len;
31287c478bd9Sstevel@tonic-gate switch (optval) {
31297c478bd9Sstevel@tonic-gate case IPOPT_EXTSEC:
31307c478bd9Sstevel@tonic-gate case IPOPT_COMSEC:
31317c478bd9Sstevel@tonic-gate case IPOPT_RA:
31327c478bd9Sstevel@tonic-gate case IPOPT_SDMDD:
31337c478bd9Sstevel@tonic-gate case IPOPT_SECURITY:
31347c478bd9Sstevel@tonic-gate /*
31357c478bd9Sstevel@tonic-gate * These options are Immutable, leave them as-is.
31367c478bd9Sstevel@tonic-gate * Note that IPOPT_NOP is also Immutable, but it
31377c478bd9Sstevel@tonic-gate * was skipped by ipoptp_next() and thus remains
31387c478bd9Sstevel@tonic-gate * intact in the header.
31397c478bd9Sstevel@tonic-gate */
31407c478bd9Sstevel@tonic-gate break;
31417c478bd9Sstevel@tonic-gate case IPOPT_SSRR:
31427c478bd9Sstevel@tonic-gate case IPOPT_LSRR:
31437c478bd9Sstevel@tonic-gate if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0)
31447c478bd9Sstevel@tonic-gate goto bad_ipv4opt;
31457c478bd9Sstevel@tonic-gate /*
31467c478bd9Sstevel@tonic-gate * These two are mutable and will be zeroed, but
31477c478bd9Sstevel@tonic-gate * first get the final destination.
31487c478bd9Sstevel@tonic-gate */
31497c478bd9Sstevel@tonic-gate off = optptr[IPOPT_OFFSET];
31507c478bd9Sstevel@tonic-gate /*
31517c478bd9Sstevel@tonic-gate * If one of the conditions is true, it means
31527c478bd9Sstevel@tonic-gate * end of options and dst already has the right
31537c478bd9Sstevel@tonic-gate * value. So, just fall through.
31547c478bd9Sstevel@tonic-gate */
31557c478bd9Sstevel@tonic-gate if (!(optlen < IP_ADDR_LEN || off > optlen - 3)) {
31567c478bd9Sstevel@tonic-gate off = optlen - IP_ADDR_LEN;
31577c478bd9Sstevel@tonic-gate bcopy(&optptr[off], &dst, IP_ADDR_LEN);
31587c478bd9Sstevel@tonic-gate }
31597c478bd9Sstevel@tonic-gate /* FALLTHRU */
31607c478bd9Sstevel@tonic-gate case IPOPT_RR:
31617c478bd9Sstevel@tonic-gate case IPOPT_TS:
31627c478bd9Sstevel@tonic-gate case IPOPT_SATID:
31637c478bd9Sstevel@tonic-gate default:
31647c478bd9Sstevel@tonic-gate /*
31657c478bd9Sstevel@tonic-gate * optlen should include from the beginning of an
31667c478bd9Sstevel@tonic-gate * option.
31677c478bd9Sstevel@tonic-gate * NOTE : Stream Identifier Option (SID): RFC 791
31687c478bd9Sstevel@tonic-gate * shows the bit pattern of optlen as 2 and documents
31697c478bd9Sstevel@tonic-gate * the length as 4. We assume it to be 2 here.
31707c478bd9Sstevel@tonic-gate */
31717c478bd9Sstevel@tonic-gate bzero(optptr, optlen);
31727c478bd9Sstevel@tonic-gate break;
31737c478bd9Sstevel@tonic-gate }
31747c478bd9Sstevel@tonic-gate }
31757c478bd9Sstevel@tonic-gate
31767c478bd9Sstevel@tonic-gate if ((opts.ipoptp_flags & IPOPTP_ERROR) != 0) {
31777c478bd9Sstevel@tonic-gate bad_ipv4opt:
3178f4b3ec61Sdh ah1dbg(ahstack, ("AH : bad IPv4 option"));
31797c478bd9Sstevel@tonic-gate freeb(phdr_mp);
31807c478bd9Sstevel@tonic-gate return (NULL);
31817c478bd9Sstevel@tonic-gate }
31827c478bd9Sstevel@tonic-gate
31837c478bd9Sstevel@tonic-gate /*
31847c478bd9Sstevel@tonic-gate * Don't change ipha_dst for an inbound datagram as it points
31857c478bd9Sstevel@tonic-gate * to the right value. Only for the outbound with LSRR/SSRR,
31867c478bd9Sstevel@tonic-gate * because of ip_massage_options called by the ULP, ipha_dst
31877c478bd9Sstevel@tonic-gate * points to the first hop and we need to use the final
31887c478bd9Sstevel@tonic-gate * destination for computing the ICV.
31897c478bd9Sstevel@tonic-gate */
31907c478bd9Sstevel@tonic-gate
31917c478bd9Sstevel@tonic-gate if (outbound)
31927c478bd9Sstevel@tonic-gate ipha->ipha_dst = dst;
31937c478bd9Sstevel@tonic-gate ah_hdr:
31947c478bd9Sstevel@tonic-gate ((ah_t *)((uint8_t *)ipha + ip_hdr_length))->ah_nexthdr =
31957c478bd9Sstevel@tonic-gate oipha->ipha_protocol;
31967c478bd9Sstevel@tonic-gate if (!ah_finish_up(((ah_t *)((uint8_t *)ipha + ip_hdr_length)),
31977c478bd9Sstevel@tonic-gate (outbound ? NULL : ((ah_t *)((uint8_t *)oipha + ip_hdr_length))),
3198f4b3ec61Sdh assoc, ah_data_sz, ah_align_sz, ahstack)) {
31997c478bd9Sstevel@tonic-gate freeb(phdr_mp);
32007c478bd9Sstevel@tonic-gate /*
32017c478bd9Sstevel@tonic-gate * Returning NULL will tell the caller to IPSA_REFELE(), free
32027c478bd9Sstevel@tonic-gate * the memory, etc.
32037c478bd9Sstevel@tonic-gate */
32047c478bd9Sstevel@tonic-gate return (NULL);
32057c478bd9Sstevel@tonic-gate }
32067c478bd9Sstevel@tonic-gate
32077c478bd9Sstevel@tonic-gate phdr_mp->b_wptr = ((uchar_t *)ipha + ip_hdr_length +
32087c478bd9Sstevel@tonic-gate sizeof (ah_t) + ah_align_sz);
32097c478bd9Sstevel@tonic-gate
32107c478bd9Sstevel@tonic-gate ASSERT(phdr_mp->b_wptr <= phdr_mp->b_datap->db_lim);
32117c478bd9Sstevel@tonic-gate if (outbound)
32127c478bd9Sstevel@tonic-gate *length_to_skip = ip_hdr_length;
32137c478bd9Sstevel@tonic-gate else
32147c478bd9Sstevel@tonic-gate *length_to_skip = ip_hdr_length + sizeof (ah_t) + ah_align_sz;
32157c478bd9Sstevel@tonic-gate return (phdr_mp);
32167c478bd9Sstevel@tonic-gate }
32177c478bd9Sstevel@tonic-gate
32187c478bd9Sstevel@tonic-gate /*
32197c478bd9Sstevel@tonic-gate * Authenticate an outbound datagram. This function is called
32207c478bd9Sstevel@tonic-gate * whenever IP sends an outbound datagram that needs authentication.
3221bd670b35SErik Nordmark * Returns a modified packet if done. Returns NULL if error or queued.
3222bd670b35SErik Nordmark * If error return then ipIfStatsOutDiscards has been increased.
32237c478bd9Sstevel@tonic-gate */
3224bd670b35SErik Nordmark static mblk_t *
ah_outbound(mblk_t * data_mp,ip_xmit_attr_t * ixa)3225bd670b35SErik Nordmark ah_outbound(mblk_t *data_mp, ip_xmit_attr_t *ixa)
32267c478bd9Sstevel@tonic-gate {
32277c478bd9Sstevel@tonic-gate mblk_t *phdr_mp;
32287c478bd9Sstevel@tonic-gate ipsa_t *assoc;
32297c478bd9Sstevel@tonic-gate int length_to_skip;
32307c478bd9Sstevel@tonic-gate uint_t ah_align_sz;
32317c478bd9Sstevel@tonic-gate uint_t age_bytes;
3232bd670b35SErik Nordmark netstack_t *ns = ixa->ixa_ipst->ips_netstack;
3233bd670b35SErik Nordmark ipsecah_stack_t *ahstack = ns->netstack_ipsecah;
3234bd670b35SErik Nordmark ipsec_stack_t *ipss = ns->netstack_ipsec;
3235bd670b35SErik Nordmark ill_t *ill = ixa->ixa_nce->nce_ill;
3236bd670b35SErik Nordmark boolean_t need_refrele = B_FALSE;
32377c478bd9Sstevel@tonic-gate
32387c478bd9Sstevel@tonic-gate /*
32397c478bd9Sstevel@tonic-gate * Construct the chain of mblks
32407c478bd9Sstevel@tonic-gate *
3241bd670b35SErik Nordmark * PSEUDO_HDR->DATA
32427c478bd9Sstevel@tonic-gate *
32437c478bd9Sstevel@tonic-gate * one by one.
32447c478bd9Sstevel@tonic-gate */
32457c478bd9Sstevel@tonic-gate
3246f4b3ec61Sdh AH_BUMP_STAT(ahstack, out_requests);
32477c478bd9Sstevel@tonic-gate
3248bd670b35SErik Nordmark ASSERT(data_mp->b_datap->db_type == M_DATA);
32497c478bd9Sstevel@tonic-gate
3250bd670b35SErik Nordmark assoc = ixa->ixa_ipsec_ah_sa;
32517c478bd9Sstevel@tonic-gate ASSERT(assoc != NULL);
32527c478bd9Sstevel@tonic-gate
32535d3b8cb7SBill Sommerfeld
32545d3b8cb7SBill Sommerfeld /*
32555d3b8cb7SBill Sommerfeld * Get the outer IP header in shape to escape this system..
32565d3b8cb7SBill Sommerfeld */
3257bd670b35SErik Nordmark if (is_system_labeled() && (assoc->ipsa_otsl != NULL)) {
3258bd670b35SErik Nordmark /*
3259bd670b35SErik Nordmark * Need to update packet with any CIPSO option and update
3260bd670b35SErik Nordmark * ixa_tsl to capture the new label.
3261bd670b35SErik Nordmark * We allocate a separate ixa for that purpose.
3262bd670b35SErik Nordmark */
3263bd670b35SErik Nordmark ixa = ip_xmit_attr_duplicate(ixa);
3264bd670b35SErik Nordmark if (ixa == NULL) {
3265bd670b35SErik Nordmark ip_drop_packet(data_mp, B_FALSE, ill,
3266bd670b35SErik Nordmark DROPPER(ipss, ipds_ah_nomem),
32675d3b8cb7SBill Sommerfeld &ahstack->ah_dropper);
3268bd670b35SErik Nordmark return (NULL);
3269bd670b35SErik Nordmark }
3270bd670b35SErik Nordmark need_refrele = B_TRUE;
3271bd670b35SErik Nordmark
3272bd670b35SErik Nordmark label_hold(assoc->ipsa_otsl);
3273bd670b35SErik Nordmark ip_xmit_attr_replace_tsl(ixa, assoc->ipsa_otsl);
3274bd670b35SErik Nordmark
3275bd670b35SErik Nordmark data_mp = sadb_whack_label(data_mp, assoc, ixa,
3276bd670b35SErik Nordmark DROPPER(ipss, ipds_ah_nomem), &ahstack->ah_dropper);
3277bd670b35SErik Nordmark if (data_mp == NULL) {
3278bd670b35SErik Nordmark /* Packet dropped by sadb_whack_label */
3279bd670b35SErik Nordmark ixa_refrele(ixa);
3280bd670b35SErik Nordmark return (NULL);
32815d3b8cb7SBill Sommerfeld }
32825d3b8cb7SBill Sommerfeld }
32835d3b8cb7SBill Sommerfeld
32847c478bd9Sstevel@tonic-gate /*
32857c478bd9Sstevel@tonic-gate * Age SA according to number of bytes that will be sent after
32867c478bd9Sstevel@tonic-gate * adding the AH header, ICV, and padding to the packet.
32877c478bd9Sstevel@tonic-gate */
32887c478bd9Sstevel@tonic-gate
3289bd670b35SErik Nordmark if (ixa->ixa_flags & IXAF_IS_IPV4) {
3290bd670b35SErik Nordmark ipha_t *ipha = (ipha_t *)data_mp->b_rptr;
32917c478bd9Sstevel@tonic-gate ah_align_sz = P2ALIGN(assoc->ipsa_mac_len +
32927c478bd9Sstevel@tonic-gate IPV4_PADDING_ALIGN - 1, IPV4_PADDING_ALIGN);
32937c478bd9Sstevel@tonic-gate age_bytes = ntohs(ipha->ipha_length) + sizeof (ah_t) +
32947c478bd9Sstevel@tonic-gate ah_align_sz;
32957c478bd9Sstevel@tonic-gate } else {
3296bd670b35SErik Nordmark ip6_t *ip6h = (ip6_t *)data_mp->b_rptr;
32977c478bd9Sstevel@tonic-gate ah_align_sz = P2ALIGN(assoc->ipsa_mac_len +
32987c478bd9Sstevel@tonic-gate IPV6_PADDING_ALIGN - 1, IPV6_PADDING_ALIGN);
32997c478bd9Sstevel@tonic-gate age_bytes = sizeof (ip6_t) + ntohs(ip6h->ip6_plen) +
3300437220cdSdanmcd sizeof (ah_t) + ah_align_sz;
33017c478bd9Sstevel@tonic-gate }
33027c478bd9Sstevel@tonic-gate
33037c478bd9Sstevel@tonic-gate if (!ah_age_bytes(assoc, age_bytes, B_FALSE)) {
33047c478bd9Sstevel@tonic-gate /* rig things as if ipsec_getassocbyconn() failed */
33057c478bd9Sstevel@tonic-gate ipsec_assocfailure(info.mi_idnum, 0, 0, SL_ERROR | SL_WARN,
33067c478bd9Sstevel@tonic-gate "AH association 0x%x, dst %s had bytes expire.\n",
3307f4b3ec61Sdh ntohl(assoc->ipsa_spi), assoc->ipsa_dstaddr, AF_INET,
3308f4b3ec61Sdh ahstack->ipsecah_netstack);
3309bd670b35SErik Nordmark BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
3310bd670b35SErik Nordmark ip_drop_output("ipIfStatsOutDiscards", data_mp, ill);
3311bd670b35SErik Nordmark freemsg(data_mp);
3312bd670b35SErik Nordmark if (need_refrele)
3313bd670b35SErik Nordmark ixa_refrele(ixa);
3314bd670b35SErik Nordmark return (NULL);
33157c478bd9Sstevel@tonic-gate }
33167c478bd9Sstevel@tonic-gate
33175d3b8cb7SBill Sommerfeld /*
33185d3b8cb7SBill Sommerfeld * XXX We need to have fixed up the outer label before we get here.
33195d3b8cb7SBill Sommerfeld * (AH is computing the checksum over the outer label).
33205d3b8cb7SBill Sommerfeld */
33215d3b8cb7SBill Sommerfeld
33227c478bd9Sstevel@tonic-gate /*
33237c478bd9Sstevel@tonic-gate * Insert pseudo header:
3324bd670b35SErik Nordmark * [IP, ULP] => [IP, AH, ICV] -> ULP
33257c478bd9Sstevel@tonic-gate */
33267c478bd9Sstevel@tonic-gate
3327bd670b35SErik Nordmark if (ixa->ixa_flags & IXAF_IS_IPV4) {
3328bd670b35SErik Nordmark phdr_mp = ah_process_ip_options_v4(data_mp, assoc,
3329bd670b35SErik Nordmark &length_to_skip, assoc->ipsa_mac_len, B_TRUE, ahstack);
33307c478bd9Sstevel@tonic-gate } else {
3331bd670b35SErik Nordmark phdr_mp = ah_process_ip_options_v6(data_mp, assoc,
3332bd670b35SErik Nordmark &length_to_skip, assoc->ipsa_mac_len, B_TRUE, ahstack);
33337c478bd9Sstevel@tonic-gate }
33347c478bd9Sstevel@tonic-gate
33357c478bd9Sstevel@tonic-gate if (phdr_mp == NULL) {
3336f4b3ec61Sdh AH_BUMP_STAT(ahstack, out_discards);
3337bd670b35SErik Nordmark ip_drop_packet(data_mp, B_FALSE, ixa->ixa_nce->nce_ill,
3338f4b3ec61Sdh DROPPER(ipss, ipds_ah_bad_v4_opts),
3339f4b3ec61Sdh &ahstack->ah_dropper);
3340bd670b35SErik Nordmark BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
3341bd670b35SErik Nordmark if (need_refrele)
3342bd670b35SErik Nordmark ixa_refrele(ixa);
3343bd670b35SErik Nordmark return (NULL);
33447c478bd9Sstevel@tonic-gate }
33457c478bd9Sstevel@tonic-gate
3346bd670b35SErik Nordmark phdr_mp->b_cont = data_mp;
3347bd670b35SErik Nordmark data_mp->b_rptr += length_to_skip;
3348bd670b35SErik Nordmark data_mp = phdr_mp;
33497c478bd9Sstevel@tonic-gate
33507c478bd9Sstevel@tonic-gate /*
3351bd670b35SErik Nordmark * At this point data_mp points to
3352bd670b35SErik Nordmark * an mblk containing the pseudo header (IP header,
33537c478bd9Sstevel@tonic-gate * AH header, and ICV with mutable fields zero'ed out).
33547c478bd9Sstevel@tonic-gate * mp points to the mblk containing the ULP data. The original
3355bd670b35SErik Nordmark * IP header is kept before the ULP data in data_mp.
33567c478bd9Sstevel@tonic-gate */
33577c478bd9Sstevel@tonic-gate
33587c478bd9Sstevel@tonic-gate /* submit MAC request to KCF */
3359bd670b35SErik Nordmark data_mp = ah_submit_req_outbound(data_mp, ixa, length_to_skip, assoc);
3360bd670b35SErik Nordmark if (need_refrele)
3361bd670b35SErik Nordmark ixa_refrele(ixa);
3362bd670b35SErik Nordmark return (data_mp);
33637c478bd9Sstevel@tonic-gate }
33647c478bd9Sstevel@tonic-gate
3365bd670b35SErik Nordmark static mblk_t *
ah_inbound(mblk_t * data_mp,void * arg,ip_recv_attr_t * ira)3366bd670b35SErik Nordmark ah_inbound(mblk_t *data_mp, void *arg, ip_recv_attr_t *ira)
33677c478bd9Sstevel@tonic-gate {
3368bd670b35SErik Nordmark ah_t *ah = (ah_t *)arg;
3369bd670b35SErik Nordmark ipsa_t *assoc = ira->ira_ipsec_ah_sa;
3370bd670b35SErik Nordmark int length_to_skip;
3371bd670b35SErik Nordmark int ah_length;
3372bd670b35SErik Nordmark mblk_t *phdr_mp;
3373bd670b35SErik Nordmark uint32_t ah_offset;
3374bd670b35SErik Nordmark netstack_t *ns = ira->ira_ill->ill_ipst->ips_netstack;
3375f4b3ec61Sdh ipsecah_stack_t *ahstack = ns->netstack_ipsecah;
3376f4b3ec61Sdh ipsec_stack_t *ipss = ns->netstack_ipsec;
33777c478bd9Sstevel@tonic-gate
33787c478bd9Sstevel@tonic-gate ASSERT(assoc != NULL);
33797c478bd9Sstevel@tonic-gate
33807c478bd9Sstevel@tonic-gate /*
33817c478bd9Sstevel@tonic-gate * We may wish to check replay in-range-only here as an optimization.
33827c478bd9Sstevel@tonic-gate * Include the reality check of ipsa->ipsa_replay >
33837c478bd9Sstevel@tonic-gate * ipsa->ipsa_replay_wsize for times when it's the first N packets,
33847c478bd9Sstevel@tonic-gate * where N == ipsa->ipsa_replay_wsize.
33857c478bd9Sstevel@tonic-gate *
33867c478bd9Sstevel@tonic-gate * Another check that may come here later is the "collision" check.
33877c478bd9Sstevel@tonic-gate * If legitimate packets flow quickly enough, this won't be a problem,
33887c478bd9Sstevel@tonic-gate * but collisions may cause authentication algorithm crunching to
33897c478bd9Sstevel@tonic-gate * take place when it doesn't need to.
33907c478bd9Sstevel@tonic-gate */
33917c478bd9Sstevel@tonic-gate if (!sadb_replay_peek(assoc, ah->ah_replay)) {
3392f4b3ec61Sdh AH_BUMP_STAT(ahstack, replay_early_failures);
3393f4b3ec61Sdh IP_AH_BUMP_STAT(ipss, in_discards);
3394bd670b35SErik Nordmark ip_drop_packet(data_mp, B_TRUE, ira->ira_ill,
3395f4b3ec61Sdh DROPPER(ipss, ipds_ah_early_replay),
3396f4b3ec61Sdh &ahstack->ah_dropper);
3397bd670b35SErik Nordmark BUMP_MIB(ira->ira_ill->ill_ip_mib, ipIfStatsInDiscards);
3398bd670b35SErik Nordmark return (NULL);
33997c478bd9Sstevel@tonic-gate }
34007c478bd9Sstevel@tonic-gate
34017c478bd9Sstevel@tonic-gate /*
34027c478bd9Sstevel@tonic-gate * The offset of the AH header can be computed from its pointer
34037c478bd9Sstevel@tonic-gate * within the data mblk, which was pulled up until the AH header
34047c478bd9Sstevel@tonic-gate * by ipsec_inbound_ah_sa() during SA selection.
34057c478bd9Sstevel@tonic-gate */
34067c478bd9Sstevel@tonic-gate ah_offset = (uchar_t *)ah - data_mp->b_rptr;
34077c478bd9Sstevel@tonic-gate
34087c478bd9Sstevel@tonic-gate /*
34097c478bd9Sstevel@tonic-gate * We need to pullup until the ICV before we call
34107c478bd9Sstevel@tonic-gate * ah_process_ip_options_v6.
34117c478bd9Sstevel@tonic-gate */
34127c478bd9Sstevel@tonic-gate ah_length = (ah->ah_length << 2) + 8;
34137c478bd9Sstevel@tonic-gate
34147c478bd9Sstevel@tonic-gate /*
34157c478bd9Sstevel@tonic-gate * NOTE : If we want to use any field of IP/AH header, you need
34167c478bd9Sstevel@tonic-gate * to re-assign following the pullup.
34177c478bd9Sstevel@tonic-gate */
34187c478bd9Sstevel@tonic-gate if (((uchar_t *)ah + ah_length) > data_mp->b_wptr) {
34197c478bd9Sstevel@tonic-gate if (!pullupmsg(data_mp, (uchar_t *)ah + ah_length -
34207c478bd9Sstevel@tonic-gate data_mp->b_rptr)) {
3421f4b3ec61Sdh (void) ipsec_rl_strlog(ns, info.mi_idnum, 0, 0,
34227c478bd9Sstevel@tonic-gate SL_WARN | SL_ERROR,
34237c478bd9Sstevel@tonic-gate "ah_inbound: Small AH header\n");
3424f4b3ec61Sdh IP_AH_BUMP_STAT(ipss, in_discards);
3425bd670b35SErik Nordmark ip_drop_packet(data_mp, B_TRUE, ira->ira_ill,
3426f4b3ec61Sdh DROPPER(ipss, ipds_ah_nomem),
3427f4b3ec61Sdh &ahstack->ah_dropper);
3428bd670b35SErik Nordmark BUMP_MIB(ira->ira_ill->ill_ip_mib, ipIfStatsInDiscards);
3429bd670b35SErik Nordmark return (NULL);
34307c478bd9Sstevel@tonic-gate }
34317c478bd9Sstevel@tonic-gate }
34327c478bd9Sstevel@tonic-gate
34337c478bd9Sstevel@tonic-gate /*
34347c478bd9Sstevel@tonic-gate * Insert pseudo header:
3435bd670b35SErik Nordmark * [IP, ULP] => [IP, AH, ICV] -> ULP
34367c478bd9Sstevel@tonic-gate */
3437bd670b35SErik Nordmark if (ira->ira_flags & IRAF_IS_IPV4) {
34387c478bd9Sstevel@tonic-gate phdr_mp = ah_process_ip_options_v4(data_mp, assoc,
3439f4b3ec61Sdh &length_to_skip, assoc->ipsa_mac_len, B_FALSE, ahstack);
34407c478bd9Sstevel@tonic-gate } else {
34417c478bd9Sstevel@tonic-gate phdr_mp = ah_process_ip_options_v6(data_mp, assoc,
3442f4b3ec61Sdh &length_to_skip, assoc->ipsa_mac_len, B_FALSE, ahstack);
34437c478bd9Sstevel@tonic-gate }
34447c478bd9Sstevel@tonic-gate
34457c478bd9Sstevel@tonic-gate if (phdr_mp == NULL) {
3446f4b3ec61Sdh IP_AH_BUMP_STAT(ipss, in_discards);
3447bd670b35SErik Nordmark ip_drop_packet(data_mp, B_TRUE, ira->ira_ill,
3448bd670b35SErik Nordmark ((ira->ira_flags & IRAF_IS_IPV4) ?
3449f4b3ec61Sdh DROPPER(ipss, ipds_ah_bad_v4_opts) :
3450f4b3ec61Sdh DROPPER(ipss, ipds_ah_bad_v6_hdrs)),
3451f4b3ec61Sdh &ahstack->ah_dropper);
3452bd670b35SErik Nordmark BUMP_MIB(ira->ira_ill->ill_ip_mib, ipIfStatsInDiscards);
3453bd670b35SErik Nordmark return (NULL);
34547c478bd9Sstevel@tonic-gate }
34557c478bd9Sstevel@tonic-gate
34567c478bd9Sstevel@tonic-gate phdr_mp->b_cont = data_mp;
34577c478bd9Sstevel@tonic-gate data_mp->b_rptr += length_to_skip;
3458bd670b35SErik Nordmark data_mp = phdr_mp;
34597c478bd9Sstevel@tonic-gate
34607c478bd9Sstevel@tonic-gate /* submit request to KCF */
3461bd670b35SErik Nordmark return (ah_submit_req_inbound(data_mp, ira, length_to_skip, ah_offset,
34627c478bd9Sstevel@tonic-gate assoc));
34637c478bd9Sstevel@tonic-gate }
34647c478bd9Sstevel@tonic-gate
34657c478bd9Sstevel@tonic-gate /*
34667c478bd9Sstevel@tonic-gate * Invoked after processing of an inbound packet by the
34677c478bd9Sstevel@tonic-gate * kernel crypto framework. Called by ah_submit_req() for a sync request,
34687c478bd9Sstevel@tonic-gate * or by the kcf callback for an async request.
3469bd670b35SErik Nordmark * Returns NULL if the mblk chain is consumed.
34707c478bd9Sstevel@tonic-gate */
3471bd670b35SErik Nordmark static mblk_t *
ah_auth_in_done(mblk_t * phdr_mp,ip_recv_attr_t * ira,ipsec_crypto_t * ic)3472bd670b35SErik Nordmark ah_auth_in_done(mblk_t *phdr_mp, ip_recv_attr_t *ira, ipsec_crypto_t *ic)
34737c478bd9Sstevel@tonic-gate {
34747c478bd9Sstevel@tonic-gate ipha_t *ipha;
34757c478bd9Sstevel@tonic-gate uint_t ah_offset = 0;
34767c478bd9Sstevel@tonic-gate mblk_t *mp;
347732350c00Sdanmcd int align_len, newpos;
34787c478bd9Sstevel@tonic-gate ah_t *ah;
34797c478bd9Sstevel@tonic-gate uint32_t length;
348032350c00Sdanmcd uint32_t *dest32;
348132350c00Sdanmcd uint8_t *dest;
34827c478bd9Sstevel@tonic-gate boolean_t isv4;
34837c478bd9Sstevel@tonic-gate ip6_t *ip6h;
34847c478bd9Sstevel@tonic-gate uint_t icv_len;
34857c478bd9Sstevel@tonic-gate ipsa_t *assoc;
34867c478bd9Sstevel@tonic-gate kstat_named_t *counter;
3487bd670b35SErik Nordmark netstack_t *ns = ira->ira_ill->ill_ipst->ips_netstack;
3488bd670b35SErik Nordmark ipsecah_stack_t *ahstack = ns->netstack_ipsecah;
3489bd670b35SErik Nordmark ipsec_stack_t *ipss = ns->netstack_ipsec;
3490f4b3ec61Sdh
3491bd670b35SErik Nordmark isv4 = (ira->ira_flags & IRAF_IS_IPV4);
3492bd670b35SErik Nordmark assoc = ira->ira_ipsec_ah_sa;
3493bd670b35SErik Nordmark icv_len = (uint_t)ic->ic_crypto_mac.cd_raw.iov_len;
34947c478bd9Sstevel@tonic-gate
34957c478bd9Sstevel@tonic-gate if (phdr_mp == NULL) {
3496bd670b35SErik Nordmark ip_drop_packet(phdr_mp, B_TRUE, ira->ira_ill,
3497f4b3ec61Sdh DROPPER(ipss, ipds_ah_nomem),
3498f4b3ec61Sdh &ahstack->ah_dropper);
3499bd670b35SErik Nordmark BUMP_MIB(ira->ira_ill->ill_ip_mib, ipIfStatsInDiscards);
3500bd670b35SErik Nordmark return (NULL);
35017c478bd9Sstevel@tonic-gate }
35027c478bd9Sstevel@tonic-gate
35037c478bd9Sstevel@tonic-gate mp = phdr_mp->b_cont;
35047c478bd9Sstevel@tonic-gate if (mp == NULL) {
3505bd670b35SErik Nordmark ip_drop_packet(phdr_mp, B_TRUE, ira->ira_ill,
3506f4b3ec61Sdh DROPPER(ipss, ipds_ah_nomem),
3507f4b3ec61Sdh &ahstack->ah_dropper);
3508bd670b35SErik Nordmark BUMP_MIB(ira->ira_ill->ill_ip_mib, ipIfStatsInDiscards);
3509bd670b35SErik Nordmark return (NULL);
35107c478bd9Sstevel@tonic-gate }
3511bd670b35SErik Nordmark mp->b_rptr -= ic->ic_skip_len;
35127c478bd9Sstevel@tonic-gate
3513437220cdSdanmcd ah_set_usetime(assoc, B_TRUE);
3514437220cdSdanmcd
35157c478bd9Sstevel@tonic-gate if (isv4) {
35167c478bd9Sstevel@tonic-gate ipha = (ipha_t *)mp->b_rptr;
35177c478bd9Sstevel@tonic-gate ah_offset = ipha->ipha_version_and_hdr_length -
35187c478bd9Sstevel@tonic-gate (uint8_t)((IP_VERSION << 4));
35197c478bd9Sstevel@tonic-gate ah_offset <<= 2;
35207c478bd9Sstevel@tonic-gate align_len = P2ALIGN(icv_len + IPV4_PADDING_ALIGN - 1,
35217c478bd9Sstevel@tonic-gate IPV4_PADDING_ALIGN);
35227c478bd9Sstevel@tonic-gate } else {
35237c478bd9Sstevel@tonic-gate ip6h = (ip6_t *)mp->b_rptr;
35247c478bd9Sstevel@tonic-gate ah_offset = ipsec_ah_get_hdr_size_v6(mp, B_TRUE);
35257c478bd9Sstevel@tonic-gate ASSERT((mp->b_wptr - mp->b_rptr) >= ah_offset);
35267c478bd9Sstevel@tonic-gate align_len = P2ALIGN(icv_len + IPV6_PADDING_ALIGN - 1,
35277c478bd9Sstevel@tonic-gate IPV6_PADDING_ALIGN);
35287c478bd9Sstevel@tonic-gate }
35297c478bd9Sstevel@tonic-gate
35307c478bd9Sstevel@tonic-gate ah = (ah_t *)(mp->b_rptr + ah_offset);
353132350c00Sdanmcd newpos = sizeof (ah_t) + align_len;
35327c478bd9Sstevel@tonic-gate
35337c478bd9Sstevel@tonic-gate /*
35347c478bd9Sstevel@tonic-gate * We get here only when authentication passed.
35357c478bd9Sstevel@tonic-gate */
35367c478bd9Sstevel@tonic-gate
3537f4b3ec61Sdh ah3dbg(ahstack, ("AH succeeded, checking replay\n"));
3538f4b3ec61Sdh AH_BUMP_STAT(ahstack, good_auth);
35397c478bd9Sstevel@tonic-gate
35407c478bd9Sstevel@tonic-gate if (!sadb_replay_check(assoc, ah->ah_replay)) {
35417c478bd9Sstevel@tonic-gate int af;
35427c478bd9Sstevel@tonic-gate void *addr;
35437c478bd9Sstevel@tonic-gate
35447c478bd9Sstevel@tonic-gate if (isv4) {
35457c478bd9Sstevel@tonic-gate addr = &ipha->ipha_dst;
35467c478bd9Sstevel@tonic-gate af = AF_INET;
35477c478bd9Sstevel@tonic-gate } else {
35487c478bd9Sstevel@tonic-gate addr = &ip6h->ip6_dst;
35497c478bd9Sstevel@tonic-gate af = AF_INET6;
35507c478bd9Sstevel@tonic-gate }
35517c478bd9Sstevel@tonic-gate
35527c478bd9Sstevel@tonic-gate /*
35537c478bd9Sstevel@tonic-gate * Log the event. As of now we print out an event.
35547c478bd9Sstevel@tonic-gate * Do not print the replay failure number, or else
35557c478bd9Sstevel@tonic-gate * syslog cannot collate the error messages. Printing
35567c478bd9Sstevel@tonic-gate * the replay number that failed (or printing to the
35577c478bd9Sstevel@tonic-gate * console) opens a denial-of-service attack.
35587c478bd9Sstevel@tonic-gate */
3559f4b3ec61Sdh AH_BUMP_STAT(ahstack, replay_failures);
35607c478bd9Sstevel@tonic-gate ipsec_assocfailure(info.mi_idnum, 0, 0,
35617c478bd9Sstevel@tonic-gate SL_ERROR | SL_WARN,
35627c478bd9Sstevel@tonic-gate "Replay failed for AH spi %x, dst_addr %s",
3563f4b3ec61Sdh assoc->ipsa_spi, addr, af, ahstack->ipsecah_netstack);
3564f4b3ec61Sdh counter = DROPPER(ipss, ipds_ah_replay);
35657c478bd9Sstevel@tonic-gate goto ah_in_discard;
35667c478bd9Sstevel@tonic-gate }
35677c478bd9Sstevel@tonic-gate
35687c478bd9Sstevel@tonic-gate /*
35697c478bd9Sstevel@tonic-gate * We need to remove the AH header from the original
357032350c00Sdanmcd * datagram. Best way to do this is to move the pre-AH headers
357132350c00Sdanmcd * forward in the (relatively simple) IPv4 case. In IPv6, it's
357232350c00Sdanmcd * a bit more complicated because of IPv6's next-header chaining,
357332350c00Sdanmcd * but it's doable.
35747c478bd9Sstevel@tonic-gate */
35757c478bd9Sstevel@tonic-gate if (isv4) {
35767c478bd9Sstevel@tonic-gate /*
35777c478bd9Sstevel@tonic-gate * Assign the right protocol, adjust the length as we
35787c478bd9Sstevel@tonic-gate * are removing the AH header and adjust the checksum to
35797c478bd9Sstevel@tonic-gate * account for the protocol and length.
35807c478bd9Sstevel@tonic-gate */
358132350c00Sdanmcd length = ntohs(ipha->ipha_length);
35827c478bd9Sstevel@tonic-gate if (!ah_age_bytes(assoc, length, B_TRUE)) {
35837c478bd9Sstevel@tonic-gate /* The ipsa has hit hard expiration, LOG and AUDIT. */
35847c478bd9Sstevel@tonic-gate ipsec_assocfailure(info.mi_idnum, 0, 0,
35857c478bd9Sstevel@tonic-gate SL_ERROR | SL_WARN,
35867c478bd9Sstevel@tonic-gate "AH Association 0x%x, dst %s had bytes expire.\n",
35877c478bd9Sstevel@tonic-gate assoc->ipsa_spi, assoc->ipsa_dstaddr,
3588f4b3ec61Sdh AF_INET, ahstack->ipsecah_netstack);
3589f4b3ec61Sdh AH_BUMP_STAT(ahstack, bytes_expired);
3590f4b3ec61Sdh counter = DROPPER(ipss, ipds_ah_bytes_expire);
35917c478bd9Sstevel@tonic-gate goto ah_in_discard;
35927c478bd9Sstevel@tonic-gate }
359332350c00Sdanmcd ipha->ipha_protocol = ah->ah_nexthdr;
359432350c00Sdanmcd length -= newpos;
35957c478bd9Sstevel@tonic-gate
359632350c00Sdanmcd ipha->ipha_length = htons((uint16_t)length);
359732350c00Sdanmcd ipha->ipha_hdr_checksum = 0;
359832350c00Sdanmcd ipha->ipha_hdr_checksum = (uint16_t)ip_csum_hdr(ipha);
35997c478bd9Sstevel@tonic-gate } else {
36007c478bd9Sstevel@tonic-gate uchar_t *whereptr;
36017c478bd9Sstevel@tonic-gate int hdrlen;
36027c478bd9Sstevel@tonic-gate uint8_t *nexthdr;
36037c478bd9Sstevel@tonic-gate ip6_hbh_t *hbhhdr;
36047c478bd9Sstevel@tonic-gate ip6_dest_t *dsthdr;
36057c478bd9Sstevel@tonic-gate ip6_rthdr0_t *rthdr;
36067c478bd9Sstevel@tonic-gate
36077c478bd9Sstevel@tonic-gate /*
36087c478bd9Sstevel@tonic-gate * Make phdr_mp hold until the AH header and make
36097c478bd9Sstevel@tonic-gate * mp hold everything past AH header.
36107c478bd9Sstevel@tonic-gate */
361132350c00Sdanmcd length = ntohs(ip6h->ip6_plen);
36127c478bd9Sstevel@tonic-gate if (!ah_age_bytes(assoc, length + sizeof (ip6_t), B_TRUE)) {
36137c478bd9Sstevel@tonic-gate /* The ipsa has hit hard expiration, LOG and AUDIT. */
36147c478bd9Sstevel@tonic-gate ipsec_assocfailure(info.mi_idnum, 0, 0,
36157c478bd9Sstevel@tonic-gate SL_ERROR | SL_WARN,
36167c478bd9Sstevel@tonic-gate "AH Association 0x%x, dst %s had bytes "
36177c478bd9Sstevel@tonic-gate "expire.\n", assoc->ipsa_spi, &ip6h->ip6_dst,
3618f4b3ec61Sdh AF_INET6, ahstack->ipsecah_netstack);
3619f4b3ec61Sdh AH_BUMP_STAT(ahstack, bytes_expired);
3620f4b3ec61Sdh counter = DROPPER(ipss, ipds_ah_bytes_expire);
36217c478bd9Sstevel@tonic-gate goto ah_in_discard;
36227c478bd9Sstevel@tonic-gate }
36237c478bd9Sstevel@tonic-gate
36247c478bd9Sstevel@tonic-gate /*
36257c478bd9Sstevel@tonic-gate * Update the next header field of the header preceding
36267c478bd9Sstevel@tonic-gate * AH with the next header field of AH. Start with the
36277c478bd9Sstevel@tonic-gate * IPv6 header and proceed with the extension headers
36287c478bd9Sstevel@tonic-gate * until we find what we're looking for.
36297c478bd9Sstevel@tonic-gate */
363032350c00Sdanmcd nexthdr = &ip6h->ip6_nxt;
363132350c00Sdanmcd whereptr = (uchar_t *)ip6h;
36327c478bd9Sstevel@tonic-gate hdrlen = sizeof (ip6_t);
36337c478bd9Sstevel@tonic-gate
36347c478bd9Sstevel@tonic-gate while (*nexthdr != IPPROTO_AH) {
36357c478bd9Sstevel@tonic-gate whereptr += hdrlen;
36367c478bd9Sstevel@tonic-gate /* Assume IP has already stripped it */
3637bd670b35SErik Nordmark ASSERT(*nexthdr != IPPROTO_FRAGMENT);
36387c478bd9Sstevel@tonic-gate switch (*nexthdr) {
36397c478bd9Sstevel@tonic-gate case IPPROTO_HOPOPTS:
36407c478bd9Sstevel@tonic-gate hbhhdr = (ip6_hbh_t *)whereptr;
36417c478bd9Sstevel@tonic-gate nexthdr = &hbhhdr->ip6h_nxt;
36427c478bd9Sstevel@tonic-gate hdrlen = 8 * (hbhhdr->ip6h_len + 1);
36437c478bd9Sstevel@tonic-gate break;
36447c478bd9Sstevel@tonic-gate case IPPROTO_DSTOPTS:
36457c478bd9Sstevel@tonic-gate dsthdr = (ip6_dest_t *)whereptr;
36467c478bd9Sstevel@tonic-gate nexthdr = &dsthdr->ip6d_nxt;
36477c478bd9Sstevel@tonic-gate hdrlen = 8 * (dsthdr->ip6d_len + 1);
36487c478bd9Sstevel@tonic-gate break;
36497c478bd9Sstevel@tonic-gate case IPPROTO_ROUTING:
36507c478bd9Sstevel@tonic-gate rthdr = (ip6_rthdr0_t *)whereptr;
36517c478bd9Sstevel@tonic-gate nexthdr = &rthdr->ip6r0_nxt;
36527c478bd9Sstevel@tonic-gate hdrlen = 8 * (rthdr->ip6r0_len + 1);
36537c478bd9Sstevel@tonic-gate break;
36547c478bd9Sstevel@tonic-gate }
36557c478bd9Sstevel@tonic-gate }
36567c478bd9Sstevel@tonic-gate *nexthdr = ah->ah_nexthdr;
365732350c00Sdanmcd length -= newpos;
365832350c00Sdanmcd ip6h->ip6_plen = htons((uint16_t)length);
365932350c00Sdanmcd }
36607c478bd9Sstevel@tonic-gate
366132350c00Sdanmcd /* Now that we've fixed the IP header, move it forward. */
366232350c00Sdanmcd mp->b_rptr += newpos;
366332350c00Sdanmcd if (IS_P2ALIGNED(mp->b_rptr, sizeof (uint32_t))) {
366432350c00Sdanmcd dest32 = (uint32_t *)(mp->b_rptr + ah_offset);
366532350c00Sdanmcd while (--dest32 >= (uint32_t *)mp->b_rptr)
366632350c00Sdanmcd *dest32 = *(dest32 - (newpos >> 2));
366732350c00Sdanmcd } else {
366832350c00Sdanmcd dest = mp->b_rptr + ah_offset;
366932350c00Sdanmcd while (--dest >= mp->b_rptr)
367032350c00Sdanmcd *dest = *(dest - newpos);
36717c478bd9Sstevel@tonic-gate }
367232350c00Sdanmcd freeb(phdr_mp);
36735d3b8cb7SBill Sommerfeld
36745d3b8cb7SBill Sommerfeld /*
36755d3b8cb7SBill Sommerfeld * If SA is labelled, use its label, else inherit the label
36765d3b8cb7SBill Sommerfeld */
3677bd670b35SErik Nordmark if (is_system_labeled() && (assoc->ipsa_tsl != NULL)) {
3678bd670b35SErik Nordmark if (!ip_recv_attr_replace_label(ira, assoc->ipsa_tsl)) {
3679bd670b35SErik Nordmark ip_drop_packet(mp, B_TRUE, ira->ira_ill,
3680bd670b35SErik Nordmark DROPPER(ipss, ipds_ah_nomem), &ahstack->ah_dropper);
3681bd670b35SErik Nordmark BUMP_MIB(ira->ira_ill->ill_ip_mib, ipIfStatsInDiscards);
3682bd670b35SErik Nordmark return (NULL);
3683bd670b35SErik Nordmark }
36845d3b8cb7SBill Sommerfeld }
36855d3b8cb7SBill Sommerfeld
3686d74f5ecaSDan McDonald if (assoc->ipsa_state == IPSA_STATE_IDLE) {
3687d74f5ecaSDan McDonald /*
3688d74f5ecaSDan McDonald * Cluster buffering case. Tell caller that we're
3689d74f5ecaSDan McDonald * handling the packet.
3690d74f5ecaSDan McDonald */
3691bd670b35SErik Nordmark sadb_buf_pkt(assoc, mp, ira);
3692bd670b35SErik Nordmark return (NULL);
3693d74f5ecaSDan McDonald }
36945d3b8cb7SBill Sommerfeld
3695bd670b35SErik Nordmark return (mp);
36967c478bd9Sstevel@tonic-gate
36977c478bd9Sstevel@tonic-gate ah_in_discard:
3698f4b3ec61Sdh IP_AH_BUMP_STAT(ipss, in_discards);
3699bd670b35SErik Nordmark ip_drop_packet(phdr_mp, B_TRUE, ira->ira_ill, counter,
3700f4b3ec61Sdh &ahstack->ah_dropper);
3701bd670b35SErik Nordmark BUMP_MIB(ira->ira_ill->ill_ip_mib, ipIfStatsInDiscards);
3702bd670b35SErik Nordmark return (NULL);
37037c478bd9Sstevel@tonic-gate }
37047c478bd9Sstevel@tonic-gate
37057c478bd9Sstevel@tonic-gate /*
37067c478bd9Sstevel@tonic-gate * Invoked after processing of an outbound packet by the
37077c478bd9Sstevel@tonic-gate * kernel crypto framework, either by ah_submit_req() for a request
37087c478bd9Sstevel@tonic-gate * executed syncrhonously, or by the KEF callback for a request
37097c478bd9Sstevel@tonic-gate * executed asynchronously.
37107c478bd9Sstevel@tonic-gate */
3711bd670b35SErik Nordmark static mblk_t *
ah_auth_out_done(mblk_t * phdr_mp,ip_xmit_attr_t * ixa,ipsec_crypto_t * ic)3712bd670b35SErik Nordmark ah_auth_out_done(mblk_t *phdr_mp, ip_xmit_attr_t *ixa, ipsec_crypto_t *ic)
37137c478bd9Sstevel@tonic-gate {
37147c478bd9Sstevel@tonic-gate mblk_t *mp;
37157c478bd9Sstevel@tonic-gate int align_len;
37167c478bd9Sstevel@tonic-gate uint32_t hdrs_length;
37177c478bd9Sstevel@tonic-gate uchar_t *ptr;
37187c478bd9Sstevel@tonic-gate uint32_t length;
37197c478bd9Sstevel@tonic-gate boolean_t isv4;
37207c478bd9Sstevel@tonic-gate size_t icv_len;
3721bd670b35SErik Nordmark netstack_t *ns = ixa->ixa_ipst->ips_netstack;
3722bd670b35SErik Nordmark ipsecah_stack_t *ahstack = ns->netstack_ipsecah;
3723bd670b35SErik Nordmark ipsec_stack_t *ipss = ns->netstack_ipsec;
3724bd670b35SErik Nordmark ill_t *ill = ixa->ixa_nce->nce_ill;
37257c478bd9Sstevel@tonic-gate
3726bd670b35SErik Nordmark isv4 = (ixa->ixa_flags & IXAF_IS_IPV4);
3727bd670b35SErik Nordmark icv_len = ic->ic_crypto_mac.cd_raw.iov_len;
37287c478bd9Sstevel@tonic-gate
37297c478bd9Sstevel@tonic-gate mp = phdr_mp->b_cont;
37307c478bd9Sstevel@tonic-gate if (mp == NULL) {
3731bd670b35SErik Nordmark ip_drop_packet(phdr_mp, B_FALSE, ill,
3732f4b3ec61Sdh DROPPER(ipss, ipds_ah_nomem),
3733f4b3ec61Sdh &ahstack->ah_dropper);
3734bd670b35SErik Nordmark BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
3735bd670b35SErik Nordmark return (NULL);
37367c478bd9Sstevel@tonic-gate }
3737bd670b35SErik Nordmark mp->b_rptr -= ic->ic_skip_len;
37387c478bd9Sstevel@tonic-gate
3739bd670b35SErik Nordmark ASSERT(ixa->ixa_flags & IXAF_IPSEC_SECURE);
3740bd670b35SErik Nordmark ASSERT(ixa->ixa_ipsec_ah_sa != NULL);
3741bd670b35SErik Nordmark ah_set_usetime(ixa->ixa_ipsec_ah_sa, B_FALSE);
3742437220cdSdanmcd
37437c478bd9Sstevel@tonic-gate if (isv4) {
37447c478bd9Sstevel@tonic-gate ipha_t *ipha;
37457c478bd9Sstevel@tonic-gate ipha_t *nipha;
37467c478bd9Sstevel@tonic-gate
37477c478bd9Sstevel@tonic-gate ipha = (ipha_t *)mp->b_rptr;
37487c478bd9Sstevel@tonic-gate hdrs_length = ipha->ipha_version_and_hdr_length -
37497c478bd9Sstevel@tonic-gate (uint8_t)((IP_VERSION << 4));
37507c478bd9Sstevel@tonic-gate hdrs_length <<= 2;
37517c478bd9Sstevel@tonic-gate align_len = P2ALIGN(icv_len + IPV4_PADDING_ALIGN - 1,
37527c478bd9Sstevel@tonic-gate IPV4_PADDING_ALIGN);
37537c478bd9Sstevel@tonic-gate /*
37547c478bd9Sstevel@tonic-gate * phdr_mp must have the right amount of space for the
37557c478bd9Sstevel@tonic-gate * combined IP and AH header. Copy the IP header and
37567c478bd9Sstevel@tonic-gate * the ack_data onto AH. Note that the AH header was
37577c478bd9Sstevel@tonic-gate * already formed before the ICV calculation and hence
37587c478bd9Sstevel@tonic-gate * you don't have to copy it here.
37597c478bd9Sstevel@tonic-gate */
37607c478bd9Sstevel@tonic-gate bcopy(mp->b_rptr, phdr_mp->b_rptr, hdrs_length);
37617c478bd9Sstevel@tonic-gate
37627c478bd9Sstevel@tonic-gate ptr = phdr_mp->b_rptr + hdrs_length + sizeof (ah_t);
37637c478bd9Sstevel@tonic-gate bcopy(phdr_mp->b_wptr, ptr, icv_len);
37647c478bd9Sstevel@tonic-gate
37657c478bd9Sstevel@tonic-gate /*
37667c478bd9Sstevel@tonic-gate * Compute the new header checksum as we are assigning
37677c478bd9Sstevel@tonic-gate * IPPROTO_AH and adjusting the length here.
37687c478bd9Sstevel@tonic-gate */
37697c478bd9Sstevel@tonic-gate nipha = (ipha_t *)phdr_mp->b_rptr;
37707c478bd9Sstevel@tonic-gate
37717c478bd9Sstevel@tonic-gate nipha->ipha_protocol = IPPROTO_AH;
37727c478bd9Sstevel@tonic-gate length = ntohs(nipha->ipha_length);
37737c478bd9Sstevel@tonic-gate length += (sizeof (ah_t) + align_len);
37747c478bd9Sstevel@tonic-gate nipha->ipha_length = htons((uint16_t)length);
37757c478bd9Sstevel@tonic-gate nipha->ipha_hdr_checksum = 0;
37767c478bd9Sstevel@tonic-gate nipha->ipha_hdr_checksum = (uint16_t)ip_csum_hdr(nipha);
37777c478bd9Sstevel@tonic-gate } else {
37787c478bd9Sstevel@tonic-gate ip6_t *ip6h;
37797c478bd9Sstevel@tonic-gate ip6_t *nip6h;
37807c478bd9Sstevel@tonic-gate uint_t ah_offset;
37817c478bd9Sstevel@tonic-gate
37827c478bd9Sstevel@tonic-gate ip6h = (ip6_t *)mp->b_rptr;
37837c478bd9Sstevel@tonic-gate nip6h = (ip6_t *)phdr_mp->b_rptr;
37847c478bd9Sstevel@tonic-gate align_len = P2ALIGN(icv_len + IPV6_PADDING_ALIGN - 1,
37857c478bd9Sstevel@tonic-gate IPV6_PADDING_ALIGN);
37867c478bd9Sstevel@tonic-gate /*
37877c478bd9Sstevel@tonic-gate * phdr_mp must have the right amount of space for the
37887c478bd9Sstevel@tonic-gate * combined IP and AH header. Copy the IP header with
37897c478bd9Sstevel@tonic-gate * options into the pseudo header. When we constructed
37907c478bd9Sstevel@tonic-gate * a pseudo header, we did not copy some of the mutable
37917c478bd9Sstevel@tonic-gate * fields. We do it now by calling ah_fix_phdr_v6()
37927c478bd9Sstevel@tonic-gate * with the last argument B_TRUE. It returns the
37937c478bd9Sstevel@tonic-gate * ah_offset into the pseudo header.
37947c478bd9Sstevel@tonic-gate */
37957c478bd9Sstevel@tonic-gate
37967c478bd9Sstevel@tonic-gate bcopy(ip6h, nip6h, IPV6_HDR_LEN);
37977c478bd9Sstevel@tonic-gate ah_offset = ah_fix_phdr_v6(nip6h, ip6h, B_TRUE, B_TRUE);
37987c478bd9Sstevel@tonic-gate ASSERT(ah_offset != 0);
37997c478bd9Sstevel@tonic-gate /*
38007c478bd9Sstevel@tonic-gate * phdr_mp can hold exactly the whole IP header with options
38017c478bd9Sstevel@tonic-gate * plus the AH header also. Thus subtracting the AH header's
38027c478bd9Sstevel@tonic-gate * size should give exactly how much of the original header
38037c478bd9Sstevel@tonic-gate * should be skipped.
38047c478bd9Sstevel@tonic-gate */
38057c478bd9Sstevel@tonic-gate hdrs_length = (phdr_mp->b_wptr - phdr_mp->b_rptr) -
38067c478bd9Sstevel@tonic-gate sizeof (ah_t) - icv_len;
38077c478bd9Sstevel@tonic-gate bcopy(phdr_mp->b_wptr, ((uint8_t *)nip6h + ah_offset +
38087c478bd9Sstevel@tonic-gate sizeof (ah_t)), icv_len);
38097c478bd9Sstevel@tonic-gate length = ntohs(nip6h->ip6_plen);
38107c478bd9Sstevel@tonic-gate length += (sizeof (ah_t) + align_len);
38117c478bd9Sstevel@tonic-gate nip6h->ip6_plen = htons((uint16_t)length);
38127c478bd9Sstevel@tonic-gate }
38137c478bd9Sstevel@tonic-gate
38147c478bd9Sstevel@tonic-gate /* Skip the original IP header */
38157c478bd9Sstevel@tonic-gate mp->b_rptr += hdrs_length;
38167c478bd9Sstevel@tonic-gate if (mp->b_rptr == mp->b_wptr) {
38177c478bd9Sstevel@tonic-gate phdr_mp->b_cont = mp->b_cont;
38187c478bd9Sstevel@tonic-gate freeb(mp);
38197c478bd9Sstevel@tonic-gate }
38207c478bd9Sstevel@tonic-gate
3821bd670b35SErik Nordmark return (phdr_mp);
38227c478bd9Sstevel@tonic-gate }
38237c478bd9Sstevel@tonic-gate
38245d3b8cb7SBill Sommerfeld /* Refactor me */
38257c478bd9Sstevel@tonic-gate /*
38267c478bd9Sstevel@tonic-gate * Wrapper to allow IP to trigger an AH association failure message
38277c478bd9Sstevel@tonic-gate * during SA inbound selection.
38287c478bd9Sstevel@tonic-gate */
38297c478bd9Sstevel@tonic-gate void
ipsecah_in_assocfailure(mblk_t * mp,char level,ushort_t sl,char * fmt,uint32_t spi,void * addr,int af,ip_recv_attr_t * ira)38307c478bd9Sstevel@tonic-gate ipsecah_in_assocfailure(mblk_t *mp, char level, ushort_t sl, char *fmt,
3831bd670b35SErik Nordmark uint32_t spi, void *addr, int af, ip_recv_attr_t *ira)
38327c478bd9Sstevel@tonic-gate {
3833bd670b35SErik Nordmark netstack_t *ns = ira->ira_ill->ill_ipst->ips_netstack;
3834bd670b35SErik Nordmark ipsecah_stack_t *ahstack = ns->netstack_ipsecah;
3835bd670b35SErik Nordmark ipsec_stack_t *ipss = ns->netstack_ipsec;
3836f4b3ec61Sdh
3837f4b3ec61Sdh if (ahstack->ipsecah_log_unknown_spi) {
38387c478bd9Sstevel@tonic-gate ipsec_assocfailure(info.mi_idnum, 0, level, sl, fmt, spi,
3839f4b3ec61Sdh addr, af, ahstack->ipsecah_netstack);
38407c478bd9Sstevel@tonic-gate }
38417c478bd9Sstevel@tonic-gate
3842bd670b35SErik Nordmark ip_drop_packet(mp, B_TRUE, ira->ira_ill,
3843f4b3ec61Sdh DROPPER(ipss, ipds_ah_no_sa),
3844f4b3ec61Sdh &ahstack->ah_dropper);
38457c478bd9Sstevel@tonic-gate }
38467c478bd9Sstevel@tonic-gate
38477c478bd9Sstevel@tonic-gate /*
38487c478bd9Sstevel@tonic-gate * Initialize the AH input and output processing functions.
38497c478bd9Sstevel@tonic-gate */
38507c478bd9Sstevel@tonic-gate void
ipsecah_init_funcs(ipsa_t * sa)38517c478bd9Sstevel@tonic-gate ipsecah_init_funcs(ipsa_t *sa)
38527c478bd9Sstevel@tonic-gate {
38537c478bd9Sstevel@tonic-gate if (sa->ipsa_output_func == NULL)
38547c478bd9Sstevel@tonic-gate sa->ipsa_output_func = ah_outbound;
38557c478bd9Sstevel@tonic-gate if (sa->ipsa_input_func == NULL)
38567c478bd9Sstevel@tonic-gate sa->ipsa_input_func = ah_inbound;
38577c478bd9Sstevel@tonic-gate }
3858